Homeland Security Watch

News and analysis of critical issues in homeland security

August 6, 2009

Locate, Target, and Destroy the Attackers: Filling the gap between NIMS/ICS and the law enforcement initial response in the age of urban paramilitary terrorism

Today’s guest blogger is T.J. Moody, the Assistant Sheriff for Law Enforcement Operations, with the Las Vegas Metropolitan Police Department.  He argues that homeland security needs more than the National Incident Management System (NIMS) and the Incident Command System (ICS) if we are to meet the threat of paramilitary terrorism.

The 1828 edition of Webster’s Revised Unabridged Dictionary defines “doctrine” as “whatever is laid down as true by an instructor or master.” The definition also notes “… a doctrine may be true or false; it may be a mere tenet or opinion.”

The National Incident Management System is unarguably a core part of Homeland Security’s (mostly uncollated ) doctrine.

As described by the NIMS Resource Center, NIMS :

… provides a systematic, proactive approach to guide departments and agencies at all levels … to work seamlessly to prevent, protect against, respond to, recover from, and mitigate the effects of incidents, regardless of cause, size, location, or complexity, in order to reduce the loss of life and property and harm to the environment.

NIMS was “laid down as true” in the early days of homeland security.  As doctrine, it grew out of the proven wildfire success of the incident command system.  NIMS is the public policy equivalent of being satisfied with any needle in a haystack, instead of continuing to look for the sharpest needle.

Few people routinely use the 1828 version of Webster’s dictionary.  As our understanding of language evolves, so too do our lexical tools.

NIMS as a practice also evolves.  I do not know any public safety professional with significant experience using incident command who believes NIMS provides a mechanical procedure for every operational situation.  It’s proponents present NIMS as a framework, a template; the basis for improvising intelligently around the details of a specific incident.  NIMS might not be perfect, they argue, but it gets better incrementally as we gain more experience using it.

Sometimes waiting for incrementalism to do its evolutionary work is the wrong approach.  Homeland security environments can change rapidly.  Structures and processes that worked in the past may be, as Lincoln wrote, “inadequate to the stormy present.”    When situations change, leadership may need to point to a new direction.  That is the subject of T.J. Moody’s post.
Recent developments in tactics used by terrorists in India and Pakistan demand an urgent re-examination of the urban policing model currently employed in the United States.  The National Incident Management System and the Incident Command System are tools which, in some circumstances, have an important role within law enforcement. However, these command and control structures may represent an anachronistic paradigm which could be inadequate to the evolving needs of law enforcement first-responders.  Dogmatic command and control paradigms that are heavily reliant on communications technology and centralized control often fail, and are likely to be of little value during the initial response phase to attacks such as those that occurred in Mumbai, India, and Lahore, Pakistan.

Without regard for the type of event involved, NIMS and ICS erroneously assume a consistent concentration of situational awareness at the top, and place ultimate authority in the hands of a few.   In light of recent international attacks, such assumptions may be dangerous and unreasonable.  They may lead law enforcement to train for unlikely scenarios, to the exclusion of more reality-based, practical training.

This fallacy of command and control continues to form the basis for most emergency management training in the U.S.  By consuming valuable time, resources, and attention, it may actually reduce the preparedness of law enforcement in case of an actual paramilitary terrorist event.

NIMS and ICS aspire to create a head, which, due to confusion, chaos, and unreasonable technological expectations, will be unlikely to function effectively during the initial law enforcement response to acts of paramilitary terrorism. A head is subject to decapitation in a worst case terrorism scenario, and may leave free lancing police tacticians highly vulnerable to the military style tactics and stout resistance increasingly demonstrated by Islamic terrorists.

Senior commanders armed with radios, cell phones, and the principals of ICS will be among those least likely to have good information about what is actually occurring in a worst-case scenario, and may be faced with significantly degraded communications capabilities. To train large police forces to remain dependent on hierarchical command and control paradigms to the exclusion of other alternatives is to train for failure.

Sullivan and Elkus, in their 2009 work “Preventing Another Mumbai: Building a Police Operational Art,” envision the need for an “operational—instead of purely tactical—response to paramilitary terrorism” within American policing.  Additionally, there is a need for a strategic response, one which de-emphasizes dogmatic, hierarchical models of command and control.

American urban policing must pursue a paradigm shift which envisions a radically decentralized, mission driven response model.  In the emerging paradigm, small teams will have advance mission knowledge and focus, and will be able to execute their missions in the absence of a highly centralized command authority.  Police officers and their field supervisors, if they are to survive, will need to understand and plan for their mission in advance, and will need to train and discipline themselves to respond as teams. All valuable time remaining before a future attack must be used to fully prepare our law enforcement first responders for the tactical shifts exhibited by terrorists that may represent a new “urban jihad.”

Urban police forces must train their patrol personnel—who comprise the most critical and vulnerable front line in a major incident—to recognize the signs of a terrorist attack, and to act immediately to deploy safely and effectively in small teams rather than as individuals.  Team leaders must fully grasp their role and mission, and must understand how their actions serve to support other elements of a self-executing all-agency plan, especially in the absence of effective communications.

Precinct and field level commanders must have intimate knowledge of the overall agency response plan, and must understand the role of their particular component in support of that plan.  These ad-hoc urban tactical teams will have a clear mission: locate, target, and destroy the attackers.  Centralized command and control, particularly during the first long hours of such an event, will likely have little to offer with respect to the effectiveness and survivability of the response teams.

Our collective mission will be to develop a domestic police force which can continue to perform its day-to-day duties in a way that is acceptable within a free society, but which can adapt quickly to an emerging new paradigm that assumes degraded communications, emphasizes small team leadership, and embraces decentralized command and control.

Share and Enjoy:
  • Digg
  • Reddit
  • Facebook
  • Yahoo! Buzz
  • Google Bookmarks
  • email
  • Print
  • LinkedIn


Comment by William R. Cumming

August 6, 2009 @ 4:53 am

Excellent topic for a post! Probably more than any other profession policing becomes more and more difficult with each passing year. The most recent NIMS doctrine appeared in December of last year and not sure if all the various documents referring to it and training materials updated to reflect that just six(6) months later. None-the-less NIMS does reflect one approach to a number of different problems. No question that disruption of command and control and communications was a strategy at MUMBAI! The terrorists had not just prepared well but were able to adjust well based on their intercepts of communications of response effort and knowledge of how that response effort will be run. Where fully militarized combat is occurring to regain control of a city’s streets is the issue not sure what the paradigm should be but would agree NIMS has its own limits and defects in the face of that eventuality.

Comment by Jim Garrow

August 6, 2009 @ 7:19 am

I’ve always felt that HLSWarch was the bes t homeland security blog out there, but these last two days? You guys have knocked it out of the park.

I work in public health preparedness, and yesterday’s post sounded like a colleague of mine could’ve written it. Then today’s post deals with a second frustration (?) in our field: the doctrinary belief that simply rewriting one’s plans to be NIMS-compliant will make them more effective.

I’ll admit it: we struggle to implement NIMS. As yesterday’s post put it beautifully, it’s a fight just to ensure we have enough staff to fulfill our day-to-day roles, so to have enough people to staff a response (the indians of the affair, to use an out-of-date and culturally insensitive term) let alone fill all of the necessary NIMS roles (the chiefs of the affair, as it were). Today’s post perfectly illustrated the sometimes inappropriate over-reliance on centralized command and control.

Keep up the great work,

Comment by Quin

August 6, 2009 @ 8:42 am

For an approach echoing the ideas of Officer Moody of placing decision making at the lowest possible levels to maximize speed and flexibility of response, you can look towards the idea of the Strategic Corporal by General Krulak.


The emphasis on delegating authority is proven to be effective in highly chaotic environments such as that envisioned by the officer. (See here for an example)

That said, no authority will delegate its functions and decisionmaking unless it feels comfortable in doing so and a mutual trust is developed. This requires standardized training, exercises and doctrine so that higher command is confident that those below them “in the field” or at the incident are making decisions consistent with established priorties, but with the flexibility and situational awareness that can evade higher authority. Officer Moody particulary hits that point here:

Precinct and field level commanders must have intimate knowledge of the overall agency response plan, and must understand the role of their particular component in support of that plan. These ad-hoc urban tactical teams will have a clear mission: locate, target, and destroy the attackers. Centralized command and control, particularly during the first long hours of such an event, will likely have little to offer with respect to the effectiveness and survivability of the response teams.

The additional benefit to shifting decisions to those at the incident is that it should free some of the tactical burden on others so they can spend more time coordinating efforts, prioritizing resources and informing more senior decision makers of events and future operations. But there is an upfront cost to be paid in training, education, and the devolopment and memorialization of doctrine and priorities that must be paid before it is implemented. I whole heartedly agree with Officer Moody’s sentiments and the need to update NIMS/ICS to take into account newly developed ideas and take advantage of advances in technology and a cadre of well educated junior leaders.

On a somewhat related note, it would be interesting if someone had a history of the development of NIMS from the Fire Service. When I was introduced to NIMS and ICS, their concepts were grounded in the same ones taught at the Marine Corps Basic School I had attended a few years before. Given the time frame that NIMS came about, and the generation of leadership during that time period, many of whom likely had the common experience of being junior officers or NCO’s in the great wars preceeding that time, there is probably an evolutionary chain that exists to NIMS and ICS. That said, the military evolution, or at least the Marine one, of delegating authority to junior leaders on the scene has probably outpaced the civilian implementation as Officer Moody suggests.

And for those looking between a direct link between policing and Marine Corps decision cycles and the emphasis on empowering junior leaders here are some relating to 2/24 out of the greater Chicago area where they crosspolinated many of these ideas between the streets of Chicago and the area south of Baghdad in 2004.



Comment by William R. Cumming

August 6, 2009 @ 10:25 am

An excellent post by Quin! FIRESCOPE has a history of NIMS. Note however that input of technical info and even INTEL not really part of NIMS IMO!

Comment by Jason R. Goodrick

August 6, 2009 @ 12:19 pm

While I wholeheartedly agree with your concept of paramilitary terrorism preparedness for domestic police forces, I must counter your argument that NIMS detracts from this effort. First, as a NIMS instructor I would like to clarify that ICS does not restrict the ability of a strike team or task force to adjust tactics as required when a situation requires real time decision making. It also allows for branch tactical planning when localized team based responses are required. This is one of the oldest concepts of battlefield leadership in existence which still holds true. In the absence of communications from command, resort to your training, adapt to the situation, and overcome the problem.
This is a segway to my next point. It is not so much a NIMS problem as it is a leadership development problem that prohibits many domestic law enforcement managers to make good field decisions. If middle managers (Sergeants, corporals, Lieutenants) are taking away from NIMS training the concept of “I can’t make a decision without consulting command” they are not being trained correctly. Further, they may lack the confidence to make that decision without consultation because that is how they operate daily.
Too often tight budgets do not allow for leadership development of middle managers in American law enforcement. This is why you cannot draw comparisons to how Military officers lead in situations like a paramilitary terror attack. The military sends officers to training which cultivates leadership traits. NIMS training does not create leaders but the concepts of NIMS work best when applied by true leaders. It is the responsibility of law enforcement to turn mundane daily supervisors into leaders who can adapt to complex emergencies and apply NIMS concepts appropriately. This is the one sure way to help effect a positive outcome during a situation such as a paramilitary terror attack.

Comment by Clinton J. Andersen

August 6, 2009 @ 12:39 pm

I do not think that the reason NIMS & ICS were created was to save the world. Being a framework, I think their creation was much like the 9/11 commissions report in that the whole point was to give users the tools to be able to work together more effectively. Not too long ago I read an article where the Oklahoma City Fire Chief stated that his number one problem was still teamwork. The bottom line is that we simply should not be having these teamwork issues but we’re so caught up in whose doing what and who will get the credit (largely due to the fact that those institutions who are perceived as saving the world will get more funding) that we are still have these simplistic problems.

These ad-hoc urban teams are definitely a great idea, however, I think legal issues are going to be our greatest crux in the future. Each major police department, and even a significant amount of smaller ones, have tactical response teams or SWAT teams on call or working day-to-day. To transition their training to include urban warfare, much like the military branches do at their constructed city’s, would not be that difficult. They generally work well as a team, can handle a lot as well as be rapidly deployed.

In order to say “locate, target, and destroy the attackers” will not be a lower level decision but a decision that will have to come from command and control units simply because of the legal ramifications involved.

Comment by Arnold Bogis

August 6, 2009 @ 1:52 pm

Interesting post and great comments.

I’m glad I waited to add my thoughts as those with real operational experience and expertise have brought up some points I was pondering.

Mr. Goodrick confirmed my conception of NIMS (as I’m not “fluent” in the language but can “get by”) as a framework that allows assets to plug into a large scale response as seamlessly as possible because everyone starts on the same page. What it does not do is tell each discipline how to do its job. So NIMS does not dictate to a paramedic how to treat a broken limb, or to the fire service how to perform a tactical rescue or deal with a high rise fire. So it would not interfere with the police service developing its own tactics, doctrine, etc. on dealing with active shooter situations.

The author of this post dismisses NIMS and then states that police team leaders “must understand how their actions serve to support other elements of a self-executing all-agency plan, especially in the absence of effective communications.” I was under the impression that is the purpose of NIMS–to allow every agency to do their job in a manner that maximizes coordination and minimizes confusion. I will leave it to those fluent in NIMS to discuss whether perfect communication between all units is assumed or if varying degrees of communication capability is accounted for in planning.

Mr. Andersen (writing that makes me imagine Neo from The Matrix, but that is getting off topic) also brings up the good point about “locate, target, and destroy.” While I certainly do not want the police to simply try to arrest terrorists in the midst of an attack, that statement reminds me of what I’ve heard intel and military operators describe as “find, fix, and finish.” It is a mind set that while perhaps necessary in an extreme situation such as a Mumbai-style attack, is not one I want instilled in everyday police work. How will recognition of when to cross that line be taught?

A larger question is whether the terrorist tactics discussed really represent any sort of “paradigm shift” (with apologies to Kuhn for abuse of his term) or just another threat that needs to be taken into account. During the worst years of our involvement in Iraq, IEDs became the number one concern. It was taken as a given that we would soon see such devices deployed in the states. Before that, following the sarin gas attacks in the Tokyo subway, it was a chemical attack that was the assumed greatest threat. Now after Mumbai, it is the danger of the “swarm.” Unfortunately in a few years it is likely to be something else.

Not to nitpick, but I would propose avoiding the use of the term “urban jihad.” One, because it assumes an Islamic fundamentalist threat when such an attack can just as easily be carried out by any type of adversary regardless of ideology. Two, as Homeland Security Adviser John Brennan put it during his speech at CSIS today, “Describing terrorists in this way—using a legitimate term, “jihad,” meaning to purify oneself or to wage a holy struggle for a moral goal—risks giving these murderers the religious legitimacy they desperately seek but in no way deserve. Worse, it risks reinforcing the idea that the United States is somehow at war with Islam itself.”

Comment by William R. Cumming

August 6, 2009 @ 2:29 pm

The firepower in some domestic gangs is proof that Arnold’s comment is right on. We have allowed the firepower of the streets to in many cases exceed that of the forces that protect society. Mexico is learning the hard way that the relatively open border with the US is fertile ground for gun running.

Comment by Sgt. T

August 7, 2009 @ 1:25 am

Excellent post and excellent comments. For a good, and frightening, look at this problem I highly recommend John Giduck’s Terror at Beslan. The Beslan incident, and the “Nord Ost” theater siege in Moscow that preceded it, were mold breakers with regard to the way we should view active shooter events. To address Mr. Bogis’ question “A larger question is whether the terrorist tactics discussed really represent any sort of “paradigm shift” (with apologies to Kuhn for abuse of his term) or just another threat that needs to be taken into account.” the answer is yes, it is a paradigm shift. Mumbai and Beslan have field tested a new operational concept that is fundamentally different from active shooter events we have seen in this country heretofore. I call it Public Execution Theater on an Extended Time Line. These events are thoroughly prepared, well coordinated, selected for maximum victim load (think hundreds or thousands instead of dozens), and temporally elongated to ensure maximum media coverage. The barriers to entry are much lower than hijacking a commercial aircraft or acquiring/detonating a VBIED.

SWAT teams and patrol divisions have been adding active shooter response to their skill set since Columbine. This is a blessing and a curse. Most active shooter training presupposes a lone (or pair of) suicidal gunmen. (Why? Because that’s what happened last time.) I have attended active shooter training where the instructors counseled that “the first officer on the scene rush into the location and close with the shooter”. In a Mumbai-style assault this will simply result in a lot of dead officers with nothing to show for it. We need deeper, standardized training that asks the hard questions and moves beyond last decade’s policies and liability worries.

The author is dead on when he states “Senior commanders armed with radios, cell phones, and the principals of ICS will be among those least likely to have good information about what is actually occurring in a worst-case scenario…” Falling well short of active shooter scenarios are dozens of high-profile events where I’ve witnessed senior management attempt to quarterback from afar. This almost always has two results: misdirection/misallocation of resources and occupation of precious radio time to ensure thy will is being done.

Historical example: During the McDonalds mass shooting in San Ysidro, California, in 1984 SWAT snipers had a clear shot on the gunman inside the location. They were ordered to hold fire until the team commander arrived on scene. People died while the commander was en route. This isn’t offered to criticize San Diego PD or the commander, as there was simply no precedent at the time, but to illuminate what happens when decisions aren’t left to the “strategic corporal”. (Thank you Quin for introducing that idea into the mix.)

There are questions I am still seeking answers to. Can a patrol officer inserted into a Mumbai/Beslan-style incident execute a wounded suicide bomber? (Answer from management: No.) This isn’t a hypothetical. “Nord Ost” and Beslan both had suicide bombers among the attackers. Should officers proceed upon contact with IEDs? If the answer is yes, should they continue if it places hostages at risk? These are some of the dozens of decisions that “strategic corporals” are going to have to make on the fly and senior managers are going to have to account for when it’s over. We need to start having the conversation.

Comment by Arnold Bogis

August 7, 2009 @ 1:57 am

Forgive my ignorance as I am obviously not an operator of any sort, never mind someone with a law enforcement background.

But can Beslan and the Moscow theater siege be properly characterized as “active shooters?” I am probably wrong, but I assumed that the phrase meant someone who has been “shooting”, is on the move, and still shooting. In my mind Mumbai, or on a smaller scale, the Virginia Tech or Columbine incidents. Both Russian cases had hardened, paramilitary forces taking a large number of people hostage. They were not on the move nor shooting all along. The numbers involved in those cases (both hostages and terrorists) have not been seen in this country, but they seem to be of a different class (hostage situations) than Mumbai (swarming, net-centric conflict if you are in the RAND school, etc).

In terms of your argument, this distinction is important. Mumbai was constantly evolving and was a difficult situation for the local police to get a grasp, and did not allow time for specially trained forces to get to the scene. Beslan and the theater siege were both “ended” by special Russian forces that had time to stage, plan, etc. for those incidents. It was not left to local police forces.

Also, in terms of the Russian incidents you cite, the size increased, but where is the “paradigm shift?” Delta in the U.S., GSG-9 after the Munich Games incident, and other similar counter-terrorism units were founded after hostage situations. While of a smaller scale than Beslan or the Moscow theater siege, it was not a shift into a whole new world but one of scale. The response to the Moscow theater siege reflects tactics planned in advanced (if not the best deployment considering the adverse reaction to the gas used) of such an incident.

So while you may call it “Public Execution Theater on an Extended Time Line,” hostage situations even carried out on the scale of hundreds or thousands seems to already exist the planning of counter-terrorist units.

And as a side note, considering the number involved in the Oklahoma City bombing vs. Beslan, the Moscow theater siege, or Mumbai, I would argue the barrier to a VBIED is lower than such events.

Comment by Phaedrus

August 7, 2009 @ 9:23 am

Interesting stuff. The author’s combination of dictionary definitions and buzzwords like “paradigm” are a sign to me of something less that fundamental analysis of issues. In a free society, police do many tasks day-to-day, that are more order maintenance than emergency response. Is it simply a sound “doctrine” that will make the same person effective as a community officer AND commando? I don’t believe that has been shown. The critical teamwork in tactical evolutions that Moody writes about does not come without significant trust among tactical operators – trust built through time spent together working through tactical challenges. The call for decentralized, mission-based, small team tactics is sound. The believe the nations “cops on the beat” can perform the role effectively by simply changing their training and management seem premature. To believe that training and equipping ALL officers to perform effectively as commandos without organizational costs in other missions that may be unacceptable is short-sighted. Good topc. Good conversation. FAR more in-depth consideration needed.

Comment by Quin

August 7, 2009 @ 11:22 am

Those reading this thread may want to monitor the comments on this blog about a terror exercise occuring today in Chicago, August 7th. Much in common.


Comment by William R. Cumming

August 9, 2009 @ 9:48 am

The tragedy of MUMBAI was that it was the third time around for very similar tactics and strategies by the “Hostiles.”
As to shooting dead a suicide bomber I believe that the judgement of those on scene should not be second guessed and given quick release detonators and other devices risks are always both ways. Unfortunatley that is why excellent training and judgement is what is necessary. And don’t forget that you don’t really pay for a Constitutional lawyer to be employed as members of SWAT or police at their current payrates. Practice facilities can generate tough situations and while their may be a “school solution” it still comes down to the Officer on the scene. What we do pay for and many would disagree is that shooting into a crowd to stop a perp is a no no! And to Arnold I here you loud and clear about Beslan and other situations as not changing paradigms but I think a really close examination of open source materials may very well indicate a paradigm shift.

Comment by Arnold Bogis

August 9, 2009 @ 9:06 pm

In terms of tactics in such a situation, I can only point to the killing of an innocent in the day (or or two) after the London Tube bombings when SAS troops chased down a suspicious individual (i.e. wearing a long coat in the summer, among other indicators that are currently taught in security courses) and when he ran determined he was another potential attacker. They ran him down, and once on the ground shot him dead as they feared he was another suicide bomber. He wasn’t–just an innocent immigrant scared by the men chasing him.

I mention this not to make judgment on the difficult decisions faced by those who protect us–especially in the immediate aftermath of such an attack. But to underline that these difficult situations exist and tactics appropriate to theaters of war are not easily transferred to the home front.

Mr. Cumming, if you have suggestions regarding those open source materials you mentioned, I would be happy to receive them offline. In terms of my previous email, that scenario was another forerunner to the “swarm” threat. My point about shifts is not that the threat/tactics should not be taken into account, but whether each new one requires an entire overhaul of existing structures.

Comment by William R. Cumming

August 10, 2009 @ 6:57 am

Arnold! Plse send me you e-mail to vacationlanegrp@aol.com


Pingback by Strategic corporals and mission command | Homeland Security Watch

August 11, 2009 @ 2:45 am

[…] Police Department, offered a provocative post.  The comments generated represent the most substantive conversation HLSWatch has hosted in a very long […]

Comment by Nick Catrantzos

August 13, 2009 @ 12:07 am

Salute to Jason R. Goodrick for a cogent analysis.

It is always easier to smash than to build, and dismissing ICS and NIMS as imperfect carries little weight if one cannot offer something better in their place. ICS works if one takes the time to use it as a way of organizing, of injecting mind into the swirl of events. In another arena, it offers a modern organizing principle which Bill Gates described as being scaleable without having permanent mass (in a decade-old book, The Road Ahead).

ICS may be a little like democracy: frustrating, flawed, far from perfect — yet still lacking a competent rival. At least it makes sense and allows room for adaptation. Can one say the same for FEMA’s old Integrated Emergency Management System (IEMS), which used to look like the last-ditch federal attempt to avoid embracing ICS at all costs?

Former FEMA Director James Lee Witt, when consulting for Louisiana Governor Blanco in the wake of Hurricane Katrina was heard saying that the first thing he needed was to train an apparently dysfunctional team of responders on ICS. This is not the right time to introduce the basics. By absorbing and promulgating ICS nationally, NIMS at least takes away the excuse that responders had no idea how to organize and plug into some kind of standard structure when contending with mutual aid.

The Assistant Chief of Fairfax County Fire responding to the 9/11/01 airline attack on the Pentagon was unexpectedly invited back by military brass who were impressed with the way fire fighters responded. They wanted to know more about that ICS tool. The irony is that much of ICS has its origins in military organizing principles, including unity of command.

Don’t blame ICS or NIMS for bad judgment or worse leadership, however. As Sgt. T laments bad judgment calls by leaders who prevented line SWAT officers from reducing the carnage at San Ysidro — this kind of thing happens independently of ICS, NIMS, or any other organizing system or standard. There is no substitute for competence, and no system immune from its opposite.

RSS feed for comments on this post. TrackBack URI

Leave a comment

XHTML: You can use these tags: <a href="" title=""> <abbr title=""> <acronym title=""> <b> <blockquote cite=""> <cite> <code> <del datetime=""> <em> <i> <q cite=""> <s> <strike> <strong>