The credentialing of private-sector disaster-support personnel presumes a very strong public-private partnership. The development of a true public/private-sector disaster credentialing system is a significant challenge. The goal is to create common credentials for public and private-sector first responders and emergency managers by working on key screening initiatives, including ways to foster the interoperability of credentialing systems for federal, state, tribal, and local governments.
A cautionary note should be mentioned, though: emergency managers and first responders are not at the present time generally credentialed themselves. Even in that context, however, there are not only multiple barriers to but also effective facilitators of such vital partnerships between the public and private sectors that must precede a wide and robust credentialing system – which should include at least some and preferably all of the following:
- The education of each sector on the unique needs of the other sector and the resources available. A few years ago, EDS and ICF International worked on several projects – including an inventory of private-sector assets in the National Capitol Region that could be used during a catastrophic disaster – related to a program initiated by the Greater Washington Board of Trade’s Emergency Preparedness Task Force. The result was stunning when it was realized the vast amount of resources that actually could be made available, under close and trusted public-private partnerships.
- The evolution of public policies, established procedures, and best practices for the coordination of disaster-recovery activities between the two sectors before, during, and following a disaster – with special focus on credentialing and access to the private sector’s own businesses, including those within the disaster area itself, when providing assistance. One can only imagine the added problems the victims of Katrina would have had without the immense help provided by WalMart, Home Depot, and Lowe’s, as well as many other private-sector partners.
- Advocacy and promotion of the importance of an effective relationship between the two sectors at local, state, tribal, national, and international levels.
- The development of a repository of lessons learned, case studies, empirical data, and collective research on the need for and the benefits likely to flow from an effective partnership between the two sectors.
- The fostering of academic programs and degrees in the same field, as well as research and development on the benefits previously achieved by cooperation and collaboration between the private and public sectors during major disasters.
The necessary first step in such an innovative program would be securing government-wide attention and support, as well as: (a) Seeing and articulating the need; (b) Committing to something new and previously untried; (c) Providing the level of comfort needed to ensure that local control will not be lost; and (d) Developing a system that is both manageable and secure.
Why Is a Credentialing System Needed?
In addition to serving as a means of raising awareness of the critical importance of business continuity to the government itself, a credentialing system also: Creates a formal system and process for achieving access; Helps protect critical infrastructure while also promoting safety, security, and economic recovery; Saves the time and manpower wasted when ad hoc processes lacking effectiveness and security prevail; Forces businesses through the process of identifying the real essentials, resulting in an improved response; Changes the dynamics of response (because the government’s primary concerns during a crisis are professional control and ensuring public safety); Solves the issue of maintaining control and allowing access to a disaster site; and Ensures uniformity of credentialing, providing easier and quicker recognition.
The private sector also benefits, though, because it can: rescue vaulted assets; retrieve vital records; power down its own networks, mainframes, and servers; retrieve both laptops and servers; recover files, computer records, microfiche, and back-up tapes; begin clean-up and restoration work; restore critical operations and customer services; and avoid severe financial loss and a probable loss of customers.
A corporate emergency access system should have at least two characteristics: (1) Through a written agreement with the local jurisdiction, it will allow priority emergency access (when safety permits); and (2) It will be fully funded by the private-sector participants.
FRAC, FIPS 201, and Future Olympics
Approximately eight months ago (19 July 2007), the Department of Homeland Security (DHS) took a major step in implementing its system for credentialing public and private-sector first responders by conducting a demonstration in Washington, D.C., and several other cities throughout the country. In addition to participating in the DHS-sponsored event, private-sector entities and officials played an important leadership role by organizing credentialing in the financial sector. At that time, Chicago, Pittsburgh, Harrisburg, Denver, Jacksonville, and several localities within the National Capital Region – as well as a number of states across the nation – sought to test the technical capabilities of and familiarize participants with the First Responder Authentication Credential (FRAC) system.
FRAC, a DHS initiative, uses the technology components of Federal Information Processing Standard 201 (FIPS 201) to verify identities with the goal of providing incident commanders with the electronic capability to grant emergency-access privileges into, out of, or within an incident area to first responders, response support staff, and critical government personnel in the execution of disaster-recovery efforts.
A number of states are in the early stages of implementing the system; the City of Chicago also is evaluating it. The information gleaned from the demonstration benefited all participating jurisdictions. The system is currently being deployed in the National Capital Region.
Personnel used the electronic validation made possible by FRAC technology to identify the participants who had authorized access to the designated area by using hand-held readers to scan the “smart” credentials provided by each participant. Those credentials, used for identity assertion, used demographic information about the participants that was dynamically linked to vital attributes (certifications, authorizations, qualifications, and privileges) to serve as the basis for whether or not the participants were approved to enter the quarantined area. Establishing a credentialing system by which essential personnel will be permitted to safely access business facilities during a disaster has long been an elusive objective, and the July 2007 demonstration reflected how differing government jurisdictions use those credentials. Here it should be noted that such a system would be very useful not only during and in the aftermath of natural and/or manmade disasters but also when a U.S. city hosts the Olympics and/or a number of other special events.
The bottom line in credentialing is this: Progress is being made every day toward achievement of this seamless public-private sector preparedness, mitigation, response, and recovery goal, especially in preparing for catastrophic events – but much more still remains to be done.