Lessons Learned from the Complex Coordinated Terrorist Attacks in Brussels

By Aaron Marks, Senior Principal, Dynamis, Inc. 

On Monday, 15 May 2017 I attended an event titled “Lessons Learned from the Complex Coordinated Terrorist Attacks in Brussels” presented by Los Angeles Fire Department Assistant Chief Michael Little and sponsored by the Prince William County Department of Fire and Rescue, the Northern Virginia Fire Chiefs Committee, and the Los Angeles Fire Department. The presentation was well done. Chief Little was focused and articulate. The slide deck presented a significant amount of information without becoming overwhelming. The audience participated actively without hijacking the briefing.

While discussing the session with Alan Metzler, former Deputy Chief of Staff for Department of Homeland Security Secretary Kelly and our newest Senior Principal, I realized something that made me stop and reassess the value of Chief Little’s presentation. There were no new concepts or ideas in the information that we had just received. We had just spent three hours hearing about “lessons learned” that I had seen before:

• Establish command early and unify as additional resources respond to the incident;
• Integrated communications are essential to ensuring that responders develop and maintain a shared situational awareness and common operating picture;
• First arriving EMS units should establish the medical sector for the response and begin triage without becoming committed to treating an individual patient;
• Continuously reassess scene safety as the situation evolves – expect secondary and tertiary threats and be ready to deal with them; and
• Multi-agency pre-planning, training, and exercising reduces confusion and saves time during an actual incident or event; and

The context was different – my lessons had come from multi-alarm fires, motor vehicle collisions involving school buses and barricaded hostage situations stemming from domestic rather than a Complex Coordinated Terrorist Attack (CCTA for the acronym-addicted), but the lessons themselves were the same.

Why do we insist that responding to a terrorist attack is so much different from any other type of incident or event? The National Incident Management System (NIMS) and the Incident Command System (ICS) guidance and structures are no different for a CCTA than any other type of incident.  The incident management objectives may be expressed differently, but they are essentially the same. The skills and equipment that we use to respond to any hostage or barricade call are just as useful responding to a terrorist attack as they are to a criminal incident.

Common Incident Management Objective	CCTA Incident Management Objective
Life Safety	Stop the Killing / Stop the Dying
Stabilize the Incident	Stabilize the Incident
Protect Property & Environment	Property / Environment Conservation
Preserve Evidence	Evidence Preservation

Suggesting a return to a Capabilities Based approach towards incident management and response can trigger nightmares in those of us who remember the Target Capabilities List and its constellation of other concepts and documents, but there is value in its balanced application. We have learned, through painful experience, that the development of capability as a means unto itself does not make sense. A focus on a single risk, without recognizing that the capabilities required to manage that risk may be shared across multiple applications, is just as problematic. It suggests a balanced approach, one that manages risks and consequences smartly, and one that fields a range of capabilities and corresponding concepts of operations to ensure resilience to crises and confidence in our capability.

There is value in taking a closer look at responses to low probability, high consequence incidents such as a CCTA. However, the real value is recognizing that responding to a CCTA is not so different from our “every day” responses and that the lessons learned from those more frequent incidents and events can be applied.