COLOMBO EAC REPORTS LESSONS LEARNED FROM WHITE

UNCLAS SECTION 01 OF 04 COLOMBO 001414 SIPDIS SENSITIVE DS FOR DS/IP/SPC/WMD, DS/IP/SA, DS/SPC/EAP, AND MED E.O. 12958: N/A TAGS: AMED ASEC CE PTER SUBJECT: COLOMBO EAC REPORTS LESSONS LEARNED FROM WHITE POWDER INCIDENT REF: A. COLOMBO 01318 ¶B. COLOMBO 01326 ¶1. (SBU) Colombo EAC convened on 08/17/04 to discuss lessons learned from an anthrax letter hoax that led to the closure of the Mission 08/10-13. EAC members in attendance included the Charge', RSO, ARSO, DATT, POL, ECON, PD, ADMIN, AID, and RMO New Delhi. The EAC, chaired by the Charge', conducted a critical review of the Mission's procedures and equipment related to the white powder incident and identified several areas of improvement. Recommendations were also made regarding lessons learned. These recommendations have been listed below for wider dissemination as appropriate. ¶2. (SBU) Summary of Incident - On the morning of Tuesday 08/10/04, Charge' OMS removed a letter previously opened by the mailroom staff and addressed to the AMB, which spilled a white powder substance on her desk. She immediately notified the RSO, who evacuated the 3rd floor CAA and reacted two members of the Embassy Chem/Bio team (ARSO and DATT). GSO was contacted to shut down air conditioning on the 3rd floor. OMS was instructed to disrobe and shower in the female restroom/shower located adjacent to the EXEC office space. OMS's clothes were double bagged and she was given a chem/bio training suit for her ride home. The two-person Chem/Bio team collected and secured three samples of the powder according to DS procedures. The letter was briefly reviewed to identify it as a threat letter, then double-bagged and held as evidence. The OMS desk area was decontaminated according to DS procedures, then the Chem/Bio team decontaminated themselves in the same female restroom/shower previously used by the OMS. Although the letter had first been opened in the remote mail handling facility outside the Chancery, the contents were not removed and the letter was placed in the mail distribution system. An emergency core EAC discussed the situation with DS/IP/SPC/WMD and decided to evacuate the entire Chancery and send all employees home, including those in the Consular Section, the American Center and the International Broadcasting Bureau at Negombo. EXEC suite and Mailroom were sealed with plastic sheets and duct tape. RSO checked each third floor office to assure the individual thermostat controls were turned off. Embassy Health Officer made the determination to immediately place the OMS, the RSO, and the Mailroom employees on Cipro due to their direct exposure to the unknown substance. A determination regarding antibiotics for the rest of the Embassy community was deferred pending lab results. It was then discovered the only local lab identified in the Mission's EAP for anthrax testing had become inactive during the past year. For the local lab to become fully operational and complete the required testing would take four days, about the same time required for a sample to be expressed mailed and tested at CDC Atlanta. Attempts to locate other labs in the region were met with negative results. On Friday, 08/13/04, CDC Atlanta reported the tests of the white powder were negative, and the Mission opened for limited operations that same day. End Summary. ¶3. (SBU) What We Did Right - Post's Emergency Action Team reacted calmly, professionally, and with great competence. - DS and MED procedures were followed to the fullest extent possible. The important lesson here is that the emergency procedures were well documented and EAC members knew where to find them. - ARSO and DATT reacted quickly and with courage as the Chem/Bio response team. They were familiar with the equipment, worked well as a team, and followed procedures expertly under difficult circumstances. - The Embassy Health Officer responded promptly and provided expert advice on health concerns, but also quickly brought the appropriate administrative issues into play. He was familiar with the medical emergency, lab procedures, and relevant points of contact. - The GSO was efficient in locating and delivering containment/decontamination items whenever requested. In emergencies, innovation is often the key to obtaining necessary supplies quickly, and the GSO was extremely effective in that regard. - Mission employees responded calmly and facilitated decision-making by following management instructions promptly and without panic. Some officers were able to conduct work from home, others continued meetings off site. One officer had the presence of mind to bring a bundle of letterhead home to continue official communications on his personal computer. - Post's Emergency Action Plan worked. No plan is perfect, but the advance preparation and attention to detail that goes into an EAP makes responding to an actual emergency infinitely easier. - Headquarters support was excellent. DS/IP/SPC/WMD and MED provided expert advice on a 24-hr basis. Coordination between MED and CDC Atlanta was excellent. Special recognition should go to CDC Atlanta for a prompt turnaround of lab results. ¶4. (SBU) What We Could Have Done Better - Mail Inspection Procedures. DS procedures for outside mail inspection were in place, but it appears at the time of the incident those procedures were not closely followed. Internal inquiries by RSO and IPO determined that the envelope in question had been cut open by the mailroom and examined at one end, but the letter had not been removed or the envelope shaken out. Human nature being what it is, particularly in areas of redundant security functions such as mail or vehicle inspection, the lesson to be learned here is that it is important for supervisors to closely monitor and when necessary, retrain subordinates to assure proper security procedures are followed. - Equipment Lapses. A post-incident review of the chem/bio equipment revealed that some of the react suits had obviously been used in training exercises and were showing signs of wear and tear, particularly around the foot area. We also found most of our chemical test kits to be missing. It is unclear if the test kits had been used up as training devices or never delivered. Our inspection also revealed poor quality duct tape that failed to stick to the Tyvex suits, and a shortage of basic cleanup items such as buckets, sponges, bleach, brushes, towels/rags, and large plastic garbage cans for stowing/securing items once they are used. These items should be inventoried, pre-positioned, and dispersed throughout a facility on all floors so that at least some resources are accessible in the event one part of a building is shut down. - Training Deficiencies. RSO notes that the first time he or the ARSO had seen the sample collection kits/procedures was on the day of the emergency, despite having several chem/bio courses under their collective belts. Although DS training focus on decontamination is important, additional training in evidence collection and use of the sample collection kits would be useful. - Chem/Bio Team Attrition. Colombo's incident occurred in the middle of summer rotation. As a result, several of the Chem/Bio Team members had just recently departed post and replacements had yet to be identified. Fortunately, only two responders were needed for this particular incident. A larger scale event would have exploited our shortage of responders. - Periodic Lab Checks. There is only one lab in Sri Lanka qualified to conduct lab tests for anthrax. Once our incident occurred, we found that the lab had become inactive during the past year. No other labs were available in the region. Posts should follow up with local labs periodically to assure that they remain viable resources. One EAP recommendation in planning is to identify alternative labs in the region and obtain the necessary permits/authorizations for shipping samples ahead of time. - Change of Clothes. All employees should consider having an alternative change of clothes at the office. In the case of the OMS who opened the letter thus potentially contaminating her clothes, we were able to locate an old training chem/bio suit for her to wear home. GSO is in the process of ordering inexpensive paper jumpsuits for all embassy personnel. These clothing items should be dispersed throughout the facility in the event one section becomes contaminated or is shut down. - MSG React. In retrospect, we could have reacted the Marines for this event. They all have basic chem/bio training and would have been useful in securing the various floors and directing employees away from the hazardous area. However, consideration should be given in certain situations to keeping the Marines off the compound to preserve their health and safety for later deployment as necessary. - Air System Shut Down. The air system in Colombo's Chancery is controlled in each individual office by a thermostat switch. In some instances, an office suite may have several thermostats, one for each room. This setup had advantages and disadvantages for us in that we were able to keep air running in vital areas such as the IPC with a reasonable degree of confidence that those units were separate from the contaminated area. The disadvantage was that once the EXEC suites were sealed, we were not completely confident all thermostats inside the suites had been shut down. It is important for response teams to have a basic knowledge of a facility's air systems. - Evacuation. Colombo's incident occurred at a time when many employees were just beginning to arrive to their offices. RSO's decision to evacuate the third floor was prompt, but instruction should have been given to the MSG to prevent additional employees from entering the building, particularly since our primary entrance led employees past the potentially contaminated mailroom. In the process of evacuation, we also failed to effectively employ the floor warden system to check that the offices had in fact been cleared. - EAP Plans for Other USG Facilities. The International Broadcasting Bureau (IBB) site in Negombo is a two-hour drive north from Colombo. Had a white powder incident occurred at that location, an Embassy Chem/Bio team response with equipment would have been at least three hours away. Individual react plans with basic equipment should be in place for remote sites, including IBB and the American Center. - Evidence Collection. While the primary function of our Chem/Bio Team was not to conduct a full investigation at the time of their response, in retrospect we realized the team should have taken a bit more time to review the threat letter before securing and sealing it. Obviously, it is not possible to use a camera to photograph the evidence since the camera itself would become contaminated in the process, but we did conclude that one of the Chem/Bio Team members could have used the OMS telephone to describe the letter in greater detail and comment on the envelope markings. This would have helped us evaluate when exactly the letter was received in the mailroom, allowing a better estimate of what other mail may have been contaminated. Making note of the specific return address would have also permitted the RSO to initiate an investigation sooner. - Loose Lips Sink Ships. Within minutes of an RSO email announcement advising employees of the white powder incident, the information reached the local press with details that could only have come from within the Embassy. This placed our employees at increased risk by increasing the potential for another attack by a copy-cat. An EAC should take into consideration the political/security repercussions of information leaks surrounding a security incident and devise an appropriate strategy through its Public Diplomacy Office. ¶5. (SBU) What We Are Doing Now - Mail Inspection Procedures. The EAC approved that the plastic "gloves box" would be used to open all local mail with postage stamps, all mail with hand-written address, all mail with a hand-written return address, and all mail with a typed return address. The only local mail not opened in the "gloves box" would be local mail franked by a postage meter and having a recognized pre-printed corporate return address. This mail would be opened in the separate mail opening room, but not in the "gloves box." In addition, all inspected letters would be removed and stapled to their respective envelopes. - Mail Inspection Room. The EAC agreed that the work environment in the mail inspection room could be improved, so physical enhancements will be added to make a better workplace environment. - Update Chem/Bio Team. Post has begun immediate identification and training of replacement Chem/Bio Response Team members. - Replenish Chem/Bio Supplies. Post has conducted a comprehensive review of supply needs and replacement orders will be made. New Tyvex suits requested in Ref A have already been received from the Department and are much appreciated. Additional requests may be forthcoming. - Investigate the Letter. An investigation of the threat letter is underway (Ref B). - Disperse Supplies. Mission's Chem/Bio Incident supplies will be dispersed throughout its various facilities to avoid the risk of losing them in a single catastrophic event. Supplies to be dispersed include written procedures/guidelines, react gear, cleanup materials, and medication. - Update Contacts. Post has begun to review and update all appropriate emergency points of contact. - Containment/Decontamination Supplies - RSO and GSO have begun to inventory, resupply, and disperse necessary containment and decontamination materials. - Research Work From Home Options - In an effort to facilitate employees working from home in times of emergencies, IPC will research options for transferring Departmental email addresses to home computers, allowing employees to conduct unclassified business with the Department from home. ¶6. (U) Colombo POC for EAP issues is RSO Alex Moore (94-11-244-8601). ENTWISTLE