part2 scenario compilation css-bk

8/17/2019 Part2 Scenario Compilation CSS-BK

1/89

Part 2:

Compilation of Strategic Policy and Crisis Scenarios

April 2012

Center for Security Studies (CSS) at ETH Zurich

On behalf of the

Federal Crisis Management Training (CMT)

of the Swiss Federal Chancellery


2/89

2

Table of Contents

1. Introduction ..................................................................................................................3

2. Compilation of individual scenarios ...........................................................................4

Geopolitical scenarios ................................................................................................................. 4 Nuclear Weapons Arsenals and Nonproliferation up to 2020 ............................................................ 4 The World in 2020 (focus on Canada) ................................................... ............................................. 8 Earthquake in the unstable country of Alphaland necessitating an air evacuation operation by theEU while a chemical accident has occurred and terrorist, separatist and organized crime threatsare looming ....................................................................................................................................... 12 Instability in a former communist country ruled by dictatorship with active extremist groupsaffecting three neighbouring democratic countries .................................................... ....................... 16

Malicious attack scenarios ........................................................................................................ 18 Nuclear material smuggling incident ..................................................... ........................................... 18 Concerted cyber attack against the financial sector with significant disruption to paymentservices against the backdrop of the 2012 Olympic Games ............................................... .............. 19 Series of targeted cyber attacks ........................................................................................................ 22 Cyber attack on critical information infrastructure .................................................... ....................... 24 Severe bioterrorist attack .................................................................................................................. 26 Terrorist attacks during severe storm ..................................................... ........................................... 29 Several conventional and CBRN terrorist attacks ...................................................... ....................... 32

Nuclear Detonation: 10-Kiloton Improvised Nuclear Device....................................................... .... 33 Chemical Attack: Nerve Agent .................................................... ..................................................... 37 Radiological Attack – Radiological Dispersal Devices .................................................................... 39 Explosives Attack: Bombing Using Improvised Explosive Device.................................................. 42 Several conventional and radiological terrorist attacks during two international events .................. 45

Natural hazard scenarios .......................................................................................................... 49 Severe flooding and dam collapse after heavy rains resulting in a number of incidents .................. 49 Earthquake followed by a tsunami and other cascading events ..................................................... ... 55 Severe earthquake ..................................................... ........................................................... ............. 56 Worst credible flood ......................................................................................................................... 60 Influenza Pandemic (Germany) ........................................................................................................ 62 Influenza Pandemic (Canada) ...................................................... ..................................................... 64 Forest fires requiring international assistance .................................................. ................................. 71 Thunderstorms, drought and big fires, causing accidents and chemical spills .................................. 72

Major accident scenarios .......................................................................................................... 75

Train accident with release of dangerous chemical substances ........................................................ 75 Accident at a nuclear power plant .......................................................... ........................................... 77 Long-term power failure ..................................................... ........................................................... ... 81

Economic scenarios ................................................................................................................... 83 Global Economic Governance in 2020: The End of Globalization and the Beginning of the Eraof Regionalism .......................................................... ........................................................... ............. 83 The World Economy and Economic Development on the African Continent in 2030 ..................... 87


3/89

3

1. Introduction

The Federal Crisis Management Training (CMT) of the Swiss Federal Chancellery

deals with issues such as crisis management structures, processes, tools, and infrastructure.The CMT focuses on crisis management trainings for the staffs of the federal departmentsand chancellery, crisis communication, and on the strategic leadership exercises, whichtake place every four years.

With its activities, the CMT contributes to the preparedness of the Swiss government andadministration to effectively lead the country in times of crises.

For the organization of its strategic leadership and other exercises, the CMT, together with partners, regularly develops exercise scenarios to practice the strategic response to majorcrises. In order to facilitate this process, the CMT commissioned the Center for SecurityStudies (CSS) at ETH Zurich to develop an overview of publicly available scenarios and to

compile a set of relevant full text scenarios pertaining to strategic policy issues and crises.These compilations are intended to provide an overview of what is available as well as toserve as potential basis for the development of future exercises and source of inspiration.

The results are presented in two separate documents. In Part 1, various scenario collectionsare listed in table form with a short description of each scenario’s plot. The collections aresorted alphabetically by source and subdivided into the following groups: InternationalOrganizations, Governmental Institutions and Private Institutions. “Stand-alone” scenarioswere not included in Part1. Part 2 contains a number of scenarios in full text, which werechosen because of their representativeness or uniqueness. Most but not all of them are alsosummarized in Part 1 (only if they are part of a collection); the scenarios in Part 1 that areavailable in full text in Part 2 are highlighted.

An online search was performed to find relevant scenarios. The search strategy employedincluded looking for scenarios on a per country basis with an emphasis on the countries ofthe OECD and BRICS, as well as by using various key words such as exercise scenario,

pandemic scenario, earthquake scenario, etc. Even though this overview of scenarios grewlarger than initially expected, it is by no means complete. Nevertheless, it provides a com-

prehensive synopsis of the kinds of scenarios that are available as well as of the issues thatare sought to be unraveled with the help of scenarios.

The kinds and forms of the scenarios available are diverse. There are “future scenarios”depicting potential future developments with regard to certain topics; “exercise scenarios”

usually providing a detailed timeline of events in order to exercise particular aspects; “riskscenarios” or descriptions characterizing the nature and potential variations of a certainkind of hazard; etc.

All of these kinds of scenarios were included in this overview as long as they relate to strategic policy issues or crises and contain some kind of narrative or timeline of events.The rather large family of scenarios that are entirely based on mathematical modeling thatis not translated into some kind of narrative were not included in this compilation. Such“mathematical scenarios” are typically applied to issues such as climate change, energysupply and demand, demographics, etc. This report contains scenarios pertaining to theseissues, but not those based on calculations only.


4/89

4

2. Compilation of individual scenarios

The following is a compilation of a number of scenarios in full text, which were chosen because of their representativeness or uniqueness. Most but not all of them are also sum-marized in Part 1 as indicated. They are sorted chronologically along the following catego-ries: Geopolitical scenarios; Malicious attack scenarios; Natural hazard scenarios; Majoraccident scenarios; and Economic scenarios.

Geopolitical scenarios

Nuclear Weapons Arsenals and Nonproliferation up to 2020

Beyond the Numbers: Strategies for Global Nuclear Governance

Global Public Policy Institute, Global Governance 2020 program, April 2011

http://www.gg2020.net/fileadmin/media/gg2020/GG2020_2011_nuclear-report_web.pdf

Scenario 1: A Brave New Nuclear World (2 scenarios in total)After a 24h delay, President Obama condemns the nuclear test that Iran conducts on 1 February2012 while simultaneously affirming his readiness to begin immediate disarmament talks. Chinaand Russia follow suit and vow to uphold the UN sanctions passed a few months earlier. Iran ig-nores Obama’s olive branch, and Republicans seize the opportunity to portray Obama as a poorstrategist and a weak commander-in-chief. The Iranian fiasco and the jobless economic recoveryhelp the Republicans maintain their majority in the House and capture a small majority in the Se-nate during the November election. This setback unleashes a torrent of recriminations within theadministration, Obama having only been narrowly re-elected himself.

The administration’s disarray does little to calm Washington’s allies in the Middle East. Despitethe Netanyahu government’s efforts to reassure the Israeli public, the Iranian bomb touches a

nerve. The editors of Israel’s main English-language dailies, Haaretz and The Jerusalem Post, re-flect widespread fears when they compare the Iranian regime to Nazi Germany. Public panic pro-duces a modern Exodus as tens of thousands of Israelis with second pass- ports flee the country.Israel’s technology entrepreneurs are the backbone of its economy, but these people also representthe most mobile segment of the population, and their loss constitutes more of a brain hemorrhagethan a brain drain. Prime Minister Netanyahu orders a massive air assault on Iran’s weapons facili-ties, but before the attack begins, an American-born Israeli official with ties to a radical peace or-ganization leaks the plan to the BBC. Netanyahu is forced to stand down, and the whistle- bloweris arrested at Ben Gurion airport as she attempts to leave the country.

Propagandists working for the Iranian Republican Guard (IRG) celebrate the impending end of theJewish State. Iran’s legitimacy increases throughout the Islamic world. While Iran’s rhetoric is

menacing, its slogans are carefully calibrated to prevent Western intelligence analysts from reach-ing a consensus about the regime’s intentions. Even in Jerusalem, respected observers disagreeabout whether Israel can live with an Iranian bomb. Meanwhile, Iran’s economy continues to stag-nate despite soaring oil prices. Though the country does not enjoy a free press, some Iranian intel-lectuals publicly question the wisdom of deepening Iran’s isolation from the outside world.

Speaking at the Chancellery in Berlin, Angela Merkel declares that Germany has a historical re-sponsibility to help protect the Jewish state. In late 2012, President Sarkozy and Chancellor Merkelissue a statement of solidarity with Israel. Upon his return to Paris, Sarkozy affirms that his coun-try’s independent nuclear deterrent is the backbone of French security strategy.

In December 2012, historian-cum-Israeli Ambassador Michael Oren meets with the Saudi Arabianrepresentative to the US, Adel Al-Jubeir, at a hotel in Washington, DC. The two men exchange

intelligence information and discuss the possibility of secretly cooperating against Iran. Whileleaving the meeting, Oren is photographed by an Iranian operative. The image is widely distributed


5/89

5

throughout the Arab media and humiliates the Saudi royal family. Protesters take to the streets inRiyadh as King Abdullah repeatedly disavows any knowledge that Israeli-Saudi talks took place.

Inspired by Iran’s nuclear achievements and rhetorical posturing, a group of disaffected engineer-ing students at King Saud University create a popular website calling on Muslims around the worldto unite behind Tehran. Iran’s intelligence agency exploits the country’s newfound popularity inthe Arab world. Fluent Arabic speakers trained in the Iran-Iraq war are quietly dispatched to SaudiArabia where they declare that Sunnis and Shias ought to suspend their doctrinal differences in theinterest of protecting Islam against the Saudi royal family’s apostasy. They organize and fund anew terror group – the Guardians of Al-Masjid al-Haram.

Cracks in the (tentative) international front against Tehran appear in early 2013 when Russia re-neges on its earlier promise to cancel the sale of an advanced air defense system to Iran. The firstRussian engineers arrive within 48 hours to begin the installation. The announcement surprisessome Western diplomats (particularly in the US), though the most experienced Russia experts ex- plain the about-face as a predictable attempt to exploit European and American inaction on Iran’sweapon program. The move will complicate any future attempt to neutralize Iran’s capabilities.

The effects of the Russo-Iranian agreement are felt most acutely in the Middle East. The Saudi

Arabian government publicly offers to share its (recently acquired) nuclear weapons technologywith members of the Gulf Cooperation Council (GCC). The United Arab Emirates and Kuwait in-vite the Saudis to deploy nuclear tipped surface-to-surface missiles on their territory. Jordan, Egyptand Turkey watch the regional proliferation of nuclear weapons with alarm. Like the Arab Gulfstates, they too are alarmed by Iran’s strengthening position, but since they are not members of theGCC they do not fall under the new Saudi defense umbrella. Cairo, Am- man and Ankara requestnew security guarantees from the US, while simultaneously initiating their own nuclear research programs and asking Pakistan and North Korea for technical assistance. In March 2013, VladimirPutin succeeds Dmitry Medvedev as the president of Russia.

In early 2014, the Guardians of Al-Masjid al-Haram (operating at Iran’s behest) stage daytime as-saults on three Saudi royal compounds. The terrorists kill four princes along with dozens of their bodyguards and servants. King Abdullah declares martial law, while Osama bin Laden issues astatement congratulating his fellow travelers. Bin Laden’s public message proves to be his last. Hiswhereabouts are determined by a deep-cover Pakistani-born American spy, and in late July Ameri-can Special Forces in Afghanistan conduct a cross-border raid into Pakistan’s Northwestern Fron-tier Province. They seize bin Laden and kill his deputy, Ayman al-Zawahiri.

Obama calls a special press conference to announce bin Laden’s capture. As the 2014 midtermsapproach, Democrats in close re-election races enjoy a significant bounce in the polls by demon-strating that their party is tough on national security. Their popularity swiftly deteriorates, howev-er, when Attorney General Eric Holder announces that Mr. bin Laden will be tried in a civiliancourt (the United States District Court in Manhattan is selected as the appropriate venue). Ameri-cans prefer a military tribunal for bin Laden by a margin of three to one. Off the record, five senateDemocrats up for re-election complain that the Obama administration is “snatching defeat from the

jaws of victory.”Although they are not officially affiliated with Al Qaeda, the Guardians of Al-Masjid al-Haramvow to avenge bin Laden. The group’s Iranian handlers recruit British-born Muslims for a specta-cular suicide operation in the US. In late 2014, terrorists attack the commuter rail system in LongIsland, an airport security line in Omaha, and sink a crowded ferry in Seattle. It is the biggest coor-dinated terrorist attack anywhere in the world since 9/11. While American Muslim organizationsmove swiftly to denounce the attacks, there are reports of spontaneous violence in Dearborn andLos Angeles against people who look Muslim. The Federal Bureau of Investigation breaks up a plot against the Islamic Community Center in Washington, DC. In the meantime, American andBritish security agencies trace the origins of the recent terrorist attack back to Tehran, but sincetheir human intelligence capabilities in Iran are limited, they are unable to find the proverbial

smoking gun. The legacy of the Bush administration’s failure to find weapons of mass destructionin Iraq looms large and President Obama declines to confront the Iranians without slam-dunk evi-dence.


6/89

6

Iran’s fortunes take a dramatic turn for the worse I June of 2015 when all members of the Organi-zation of the Petroleum Exporting Countries (except Venezuela and Libya) declare their commit-ment to preserving the geopolitical status quo in the Middle East. The cartel announces that itsmembers will not export to any country that consumes Iranian oil. Within a month, the Iranianeconomy enters a tail- spin, and the regime’s hold on power appears increasingly shaky. In order todeflect attention away from the country’s economic woes, the IRG launches assaults on Dubai and

Abu Dhabi, seizing control of both cities after daring amphibious landings.Iranian university students flood the domestic blogosphere with impassioned anti-war protests, butforeign news correspondents stationed in Iran report that most citizens accept that to prevent theimpending deployment of Saudi nuclear weapons in the UAE, there was no other option. The Ira-nian government cites the precedent set by the Bush Doctrine and describes its invasion as an actof preemptive self-defense. In March of 2016, Iran withdraws from the NPT and tests a secondnuclear device that is significantly more powerful than the first. With a credible nuclear deterrentand control over both sides of the Straits of Hormuz, military action against Iran seems increasing-ly unlikely. By early 2017, oil prices hit all-time highs and inflation in industrialized countriesreaches levels not seen since the oil crises of the 1970s.

The obsolescence of the existing nonproliferation architecture is now widely acknowledged. The

effects of its collapse are particularly acute in East Asia, a region where unresolved territorial disputes (the Diaoyu Islands, the Spratly Islands, the status of Taiwan, etc.) and longstanding rivalriescontinue to generate international tension. In early 2018, the Japanese government openly re-evaluates its policy against developing nuclear weapons. While the Japanese flirted with the idea ofestablishing an independent nuclear deterrent during the 1970s and the 1980s, the American secu-rity guarantee and the public’s deep hostility to nuclear weapons (a product of being the only coun-try in the world to have suffered a nuclear attack) sufficed to keep Japan in the non-nuclear weapons club. In early March 2011, a massive magnitude 9 earthquake struck off Japan’s northeastcoast triggered a devastating tsunami and seriously damaged the Fukushima Daiichi nuclear power plant causing the release of radioactive material in Japan. The events of this catastrophe further putinto question the safety and security of Japan’s nuclear establishment. But as the NPT falls apartand memories of Hiroshima and Nagasaki fade, a younger generation of Japanese leaders do notexercise the same self-restraint. Japan’s announcement prompts Taiwan and South Korea to restarttheir inactive weapons programs.

While the Chinese foreign ministry issues stern demarches to all three governments, its mostharshly worded comments are directed towards Taiwan, which it accuses of undermining over twodecades of cross-straits confidence building. The People’s Liberation Army Navy dispatches itsnew aircraft carrier task force to the Straits. A military confrontation between Taiwan and China isnarrowly averted when Obama persuades the Taiwanese government to abandon its weapons pro-gram in return for a strongly worded statement from the White House reaffirming America’scommitment to Taiwan’s security. Policymakers in Beijing and Washington breathe a collectivesigh of relief and return to the safe and familiar business of managing their bilateral economic rela-tions.

On the 10th anniversary of the beginning of the Great Recession (August 2018), commentatorsemphasize how little global economic patterns have changed over the past 10 years, particularly inthe world’s two biggest economies. American prosperity is still largely driven by domestic con-sumption, while the Chinese continue to follow an export-oriented strategy. Global imbalances areas much a feature of economic relations in 2018 as they were in 2008. Though breathless talk of anew global order managed by “Chimerica” proved to be misguided, slow global economic growthduring the previous 10 years has deepened Sino-US interdependence. Neither Beijing nor Wash-ington has an appetite for making tough decisions on hot-button issues like nuclear nonprolifera-tion and global warming for fear of disrupting their critical, but fragile bilateral relationship.

Sino-US retrenchment aggravates existing international tensions. Though the Taiwanese yield toChinese and American pressure and discontinue their nuclear program, South Korea and Japanrefuse to follow suit. By early 2019, both countries announce that they are nuclear capable anddeclare a no-first-use policy. Washington is shocked when South Korea and Japan, two of its oldest


7/89

7

allies, bury a century of bitter history and sign an unprecedented bilateral mutual defense agree-ment. This new strategic alignment is but one of many: the Iraqi government declares its commit-ment to working with the GCC to contain Iranian ambitions in the Middle East, while diplomatsfrom India, Israel, Japan and South Korea talk about an informal coalition of nuclear armed demo-cracies.

While Northeast Asia adds two new members to the nuclear club, leaders elsewhere explore alter-native ways of reversing proliferation outside of the now-defunct NPT framework. Brazil and Rus-sia convene a high-level multilateral strategic dialogue on the future of nuclear weapons. RecallingDwight Eisenhower’s Atoms for Peace initiative, Brazil and Russia declare the establishment ofthe Atoms for Growth Project and pledge to expand access to peaceful nuclear technology in de-veloping countries in return for enhanced nonproliferation safeguards, including a new, multilateralinspection agency.

While the Russo-Brazilian program resembles the original NPT, it has one critical difference: Rus-sia and Brazil pledge to create an international fund to subsidize the cost of constructing nuclear power plants in the developing world. As major oil producers (Brazil became a top 10 exporterafter tapping into its ultra-deep water reserves in 2015), the record price of crude seems to maketheir commitment credible. Linking nonproliferation to economic development proves to be a win-

ning combination as Indonesia, South Africa and Turkey quickly sign on to the Russo-Brazilian program.


8/89

8

The World in 2020 (focus on Canada)

Canada in 2020: Identity Politics and Security, Future Scenarios

University of Ottawa, April 2009

http://www.csis-scrs.gc.ca/pblctns/cdmctrch/cnd-2020-eng.pdf

Scenario 2: The Lord of the Flies (4 scenarios in total) Axes

A decrease in participation and confidence in international institutions. Slight disparity betweenvarious affinity groups and various communities.

Context

This scenario, like the novel Lord of the Flies by W. Golding (1956), illustrates how reduced par-ticipation in international institutions and a decline in economic disparity and power incite Statesto assert themselves and to defend their own interests more aggressively in the political, economic,and social arenas.

ScenarioThe number, usefulness, raison d’être, and effectiveness of international institutions have graduallydeclined. We are experiencing a return to political realism. The States are promoting the nationalinterest in a world where international order and regulations are lacking. The failure of the United Nations (UN), which has been unable to rise to enormous challenges, such as peacekeeping mis-sions and the protection of the environment, has helped to erode the credibility of the internationalsystem as a whole. International treaties, including the old Kyoto Protocol, have been replaced byregional, bilateral agreements and other agreements of convenience.

Recent surveys show that even Canadians, who have always generally supported multilateralism,now believe that their interests and values are better served and protected by national or regionalmeasures. Countries have decreased their involvement within the UN, the World Bank, and the

International Monetary Fund. They are working more at concluding alliances and at negotiating bilateral and regional agreements.

Since their first summit in 2009, the Heads of State of Brazil, Russia, India, and China, commonlyknown as the BRIC countries, have strengthened their economic, political, and military ties andhave created a political circle that rivals the G8. Thanks to their impressive economic growth,which is mostly sustained by the continued higher prices of raw materials, the BRIC countries,where 40% of the world’s population now lives, have radically reduced the gap between the richand the poor, between the doers and the followers. They are no longer developing countries, butreal economic powers with average incomes. They are asserting themselves not only in the eco-nomic arena, but also in the geopolitical arena.

Populations on the move

The 2019 world census has shown negative emigration rates in BRIC countries. The economic riseof these four countries has reversed the traditional trends of migration flow: people no longer mi-grate from the south to the north or from the east to the west. The trends have been reversed. Foremigrants and citizens, the prospects are now brighter in emerging rather than Western countries.Canada has thus recorded a dramatic decline in immigration and even negative immigration ratesin the case of China and India.

The Canadian government is actively looking for new ways to attract immigrants and to ease ad-missibility criteria regarding language, skills, level of education, and criminal history. However,the addition of this new category of immigrants is expensive from a social and financial point ofview.

To offset the shortage of qualified labour because the most promising citizens have left for greener pastures, industries in major urban centres have lured workers from rural regions, which are todayseriously threatened. The result has been significant imbalances in the distribution of resources,


9/89

9

and the public authorities have closed hospitals and schools in these regions. The population,which has suffered the effects of these policies, has mobilized by periodically staging strikes and by setting up roadblocks which have tied up traffic and created serious tensions with the urban population.

The regions rich in resources, in particular Alberta and the Arctic, have been powerful magnets forworkers. Canada has become a political economy and a society based for the most on the develop-ment of natural resources. All the public policies proposed by Ottawa have focused on natural re-sources, the main source of wealth, of growth, and of the country’s international prestige.

Nationalism and identity in a strong State

The growth of BRIC countries outside the multilateral system has incited citizens to turn awayfrom internationalism and move towards nationalism. The States have exploited this trend and be-come very active proponents of national identity based on religious, cultural, or linguistic group.This rise in nationalism in a context where foreign interference is no longer tolerated has led to the bloody repression of anyone who opposes the strengthening of national identity. For example, theRoma and the Kurds, who refuse to assimilate into the host communities, have been exterminated.

The Government of Canada has also been involved in serious nationalist initiatives. In 2009, it has

launched the campaign “Canadians first” to foster a feeling of national pride and solidarity. Thecampaign has been successful, except in Quebec, which considers its situation precarious. Conse-quently, there is a rise in nationalist ambitions and feelings. An increasing number of Quebeckersnow think that only sovereignty will enable them to adequately defend their interests. A referen-dum will be held shortly, and Ottawa is distributing funds and launching programs in Quebec in afrantic effort to appease the population.

The effect of the diaspora has diminished, and people are seeking a sense of identity based on his-torical, religious, ethnic, and linguistic links. The rebirth of the sense of identity has opened thedoor to the overt display of ethnic and religious differences in the form of Islamic banks, separatereligious laws in secular States, and renewed political extremism. The State is nevertheless veryactive in all social areas, particularly in those areas where foreign interference is minimal. Protec-

tionism and intrusive measures are rising, even in most countries which have the economy, immi-gration, and technology under control.

Canada’s Arctic: Speed is of essence

The vulnerability of Canada’s Arctic, which has been clearly shown since the collapse of the Unit-ed Nations Convention on the Law of the Sea (UNCLOS), has forced Canada to strengthen its de-fence relations with the United States. Following Russia’s refusal to recognize Canada’s territorialclaims under the Convention, which has led to latter’s demise, the Canadian Shield program of the North American Aerospace Defence Command (NORAD) has taken effect in 2013. This programensures the territorial integrity of Canada’s Arctic by establishing an integrated land, sea, air, andspace defence system. The program obviously relies heavily on the United States in terms offinance and equipment. The costs of this security system are high. Not only must Canada share the

Arctic’s resources with its US neighbour, but also it must bring into line most of its defence poli-cies with those of the United States.

Russian ships make regular forays into Canadian territory, and Moscow is now offering Russiancitizenship to inhabitants of the contested territories, notably to members of the Aboriginal com-munities who live in the Arctic Islands. The problem is delicate, as the presence in this region ofAboriginal peoples, whom Canada considers its citizens, is one of the cornerstones of the argumentconcerning the recognition of Canadian sovereignty over the Arctic Islands. Each side is fightingfor their loyalty, and Canada is waging a fierce struggle using recognition agreements, social pro-grams, and, above all, settlements.

A New Cold War

The weakening of international institutions has led to the expansion of regional networks. TheArab League, the BRIC, the EU, the ASEAN, the African Union, and the bloc consisting of thethree countries of North America have now become the designated spokespersons on the interna-


10/89

10

tional scene. Naturally, it has been difficult to reach a consensus on how to solve “global prob-lems” in a system where each State defends only its own interests.

At the end of the “BRIC 2020” summit, the leaders of Brazil, Russia, India, and China issued astatement in which they called for a renewed commitment to the unconditional respect for territori-al and national sovereignty. This stance is evidently aimed at the controversial reinforcement of theUS military presence in Central Asia and the Caucasus. The United States has negotiated militaryagreements with several governments and has established military bases in Azerbaijan and Georgiato protect the Baku-Tbilisi-Chechnya oil pipeline. The presence of US troops in their “backyard”irritates in particular Russia and China and compromises their influence in these regions. Finally,the launch of drones over Chinese and Russian territories from these bases has increased tensions.

In 2020, China is the largest donor country to Africa, overtaking even the World Bank. This facthas considerably undermined the West’s influence over the continent. China buys resources andraw materials and finances infrastructure, without regard for how the various regimes in power usethe money received. This is how al-Bashir’s government succeeded in Darfur. Authoritarian re-gimes have been benefiting from Russia’s and China’s struggle to acquire a market share of thelucrative weapons industry. As the prices are low and natural resources are exchanged for weapons, the proliferation of weapons has increased on an unprecedented scale in unstable regions and

among terrorist and organized crime groups.

Not only are the weapons less and less expensive, but they are also increasingly sophisticated. TheUS Department of Defence has invested heavily in the manufacture of military robots, and itsdrones regularly patrol the air space around its military bases abroad and in Canada’s Arctic. Theseunmanned vehicles are used in the air, on land, and even under water. These technological ad-vances are now an essential component of an effective system to monitor Canada’s territory in theArctic.

The media is warning of a new Cold War between the West and the BRIC countries followingIran’s recent nuclear tests in the Kavir Desert and in light of the massive proliferation of weaponsaround the world. Thus, in 2020, clearly, the world, which was once comprehensible and lawful,has been turned upside down.

Security risk evaluation (scenario assessment)

The scenario of the Lord of the Flies predicts a heightened threat to national defence and territorialintegrity because of terrorism and the use of weapons of mass destruction against Canada, its inter-ests, and its allies, as well as espionage and subversion against Canada, its capacity to protect anddefend its interests, its economic competitiveness, and the well-being of Canadians.

The threat to territorial integrity and national defence has primarily increased because of the vulne-rability of the Canadian Arctic and the hostile gestures of neighbouring countries. During WorldWar II, the Arctic was a strategic crossing point for submarines. The opening of the NorthwestPassage and, particularly, the development of natural resources herald a new strategic interest inthe region.

None of the scenario’s driving forces suggests any change concerning the risks of terrorist attacksagainst Canada, its citizens, and its interests. With the tightening of borders and the strengthenedrole of the State, the government should be able to implement counter terrorist measures and tocounter the plans of terrorist cells that are planning attacks in Canada. We have not included herethe terrorist acts committed in the course of armed conflicts, which would instead be the subject ofa military analysis.

The heightened terrorist threat and the increased use of weapons of mass destruction against Cana-da and its interests or its allies have important consequences and stem from several factors: i) the proliferation of weapons has increased on an unprecedented scale, and a number of authoritarianregimes and criminal groups are profiting from this situation; ii) the harmonization of Canadianand US foreign policies makes Canada vulnerable to the threat posed by enemies of the United

States; and iii) a World War III scenario is taking shape following Iran’s nuclear tests and thegrouping of countries into geopolitical blocs.


11/89

11

Also, secrets, and hence sensitive and classified information, are even more important in periods ofheightened geopolitical tensions. Thus, in a scenario which foresees World War III, the threat ofespionage and subversion undoubtedly increase. According to certain scenarios, the acceptance ofimmigrants whom the country cannot “integrate” or who do not want to integrate increases thevulnerability of Canada and its institutions.

The BRIC countries are the dominant economies and are depriving Western economies of labour,clients, market shares, and financing possibilities. These countries are now dictating economic andfinancial relations. Furthermore, Canada, which has vast natural resources, sees its economy focus-ing on these sectors and abandoning innovation and future growth sectors. Education, industry,immigration, and integration policies will have a strong impact on labour and its quality. The competitiveness of the country will largely depend on these policies.

In certain areas, given the development of driving forces in the Lord of the Flies scenario, the riskdiminishes. As countries isolate themselves and promote strong nationalist feelings, the State is playing a larger role and is firmly running the country. In this context, the vulnerability of Canadaand its democratic institutions in the face of foreign-influenced activities is declining, as is thethreat to peace, public order, and good governance.


12/89

12

Earthquake in the unstable country of Alphaland necessitating an air evacuation opera-

tion by the EU while a chemical accident has occurred and terrorist, separatist and or-

ganized crime threats are looming

French Air Force Air Defence and Air Operations Command: Exercise BAPEX 2008

http://bapex08-gb.over-blog.com/pages/General_situation-847595.html

Alphaland (scenario background setting)

Identification

Defined land borders: Bravoland, Charlyland.

Conventional long name: Republic of Alphaland.

Nationality (noun): Alphalandian(s).

Nationality (adjective): Alphalandian.

Official language: Alphalandian is the main, official and widely used language.

Popuplation: 7 400 000.

Capital: Lille.

Flag:

National history

Alphaland was discovered in the early 16th century and became the colony of several Europeancountries before achieving its independence in 1889. After a short period of instability, the Repub-lic of Alphaland was formed in 1901. The country took advantage of the two world wars providingraw materials to the belligerents. During the second part of the 20th century, Alphaland was subject to the influence of the two political blocs and government authorities became more and morecorrupted. At the same time, relationships with neighbouring countries became strained with adiminution of the regional trade and a direct impact on small producers. Alphaland entered the 21stcentury isolated, with an ageing infrastructure and an economy undergoing crisis.

In 2006, demonstrations occurred in big cities and miners went on strikes. At the same time, theMafia, favoured by the lack of public administration and police forces action, took control overlarge parts of the underground economy, including drug trafficking for Western countries, and theinsecurity started growing. Moreover, political and religious terrorist organizations emerged, con-tributing to a more destabilizing situation.

Geography

Terrain: Alphaland is a relatively flat country without mountain, only few hills are present and thehighest points, in the north-east region and close two Reims never exceed 400m. The country isdominated by large plains and forests with a significant hydrograph. The country’s coastlines aremainly made of sand beaches along coastal plains except in the north-east region which is domi-nated by rocky cliffs. Alphaland, situated between two major geological plateaux is susceptible toearthquakes and volcanic eruptions.

Climate: Alphaland climate is hot and humid in the summer, hot and dry in the winter. Summertime brings heavy rainfalls causing regular floods.

Natural Resources: Alpahaland underground is rich in raw materials (Nickel, coal, iron), especiallyaround Reims region and mine exploitation is generally performed under the direction of foreigncompanies. Several thousands of European citizens work in these companies and live in the Reims

area.


13/89

13

Energy: Hydroelectricity, coal, and imported oil provide the basic sources of energy. The Refiningcapacity is limited, with one ageing refinery on the north-east coast in the vicinity of Boulogne.Crude and refined oil are imported and some foreign oil companies are prospecting for possiblefuture off-shore exploitation.

The government

President : Hector Punto (He was re-elected in 2003 for a second six year mandate) Head of Government : Charles Phungus

Most of the political authorities have been elected democratically, though some irregularities have been reported in several places.

Foreign Policy: The Alphalandian government mainly focuses on the homeland policy, but the

incapacity to reach custom agreements with Bravoland and Chralyland led to the closure of bordersin 2004 and the end of diplomatic relations with these two countries.

Land border disputes: Nothing significant.

Maritime border disputes: Nothing significant.

Representation Abroad : Alphaland is a member of the UN organization. The European embassiesare located in Lille and some consulates are in Reims.

Internal Political Situation: After years of prosperity and welfare, Alphalandian discovered theirelite was corrupted when recession started. A large part of the country’s income was not redistrib-uted to invest in the equipment maintenance necessary, whilst public administration (including the police and armed forces) was neglected.

Infrastructure

Roads: The road network links up most large towns and villages. Although the maintenance ofroads suffers from low budget investments, roads are still in reasonably good conditions. A high-way network built in the 70’s covers the country and allows fast exchanges. Yet a clash occurred in2003, when Alphaland decided to increase taxes on goods transportation between the national portsand bordering countries.

Railway facilities: Alphaland railway network was initially built in the early 20th century to favourthe transportation of raw materials from mines to the main ports and it was later extended to civiltransportation. After years of negligence, the network is today in a poor condition and passengersoften complain about important delays due to technical problems.

Power facilities: Three thermal (1xfuel and 2xcoal) and a dozen hydroelectric power facilitiesshould provide the country with sufficient energy. However, the inefficient management of powerdistribution induces numerous power cuts and the pollution produced by the coal power factoriesincrease the general discontent.

Ports: Alphaland Lakuta has the following ports: Calais, Boulogne and Dunkerque on the WesternSea and Valenciennes on the Eastern Sea. Calais is specialized in raw material transit from and toAlphaland; the port can handle roll-on/off and container cargo boats, as well as tankers. Dunkerquehas a long commercial history, being the first harbour of the country; the port processed 400,000containers in 2000, but the overall volume of cargo processed decreased by 35 per cent between2003 and 2005 due to the breakdown of commercial relations with Bravoland and Charyland. Bou-logne and Valenciennes are fishing ports and satisfy most of Alphaland’s needs.

Airports: Lille INTL is the only international airport in the country and many other airfields areavailable throughout the country for domestic flights. Twelve international airliners provide regu-


14/89

14

lar flights to Lille and the number of international passengers transiting through Lille was about168,000 in 2006. The Alphaland Airways fleet in 2008 includes nine aircraft, with 4 Boeing 737sused for international flights, and 5 Fokker F-27s used for domestic flights.

Police and Armed Forces

Police

Placed under the authority of the Ministry of the Interior, and headed by the Police Director: JulioFoucay, the strength of the national police is about 15,000 personnel. Police stations are deployedin every city including a population equal or superior to 5,000 inhabitants. In the countryside, each police station has control over the surrounding area comprising less important towns.

Value: Due to the corruption problems, ageing equipments and the lack of political will to fightagainst crime, the police forces are mostly assessed to be weak; only The Republican SecurityGuard is efficient. With a strength of 1,500 well-paid and well-equipped guards, the mission of thisorganization which is based in the capital is to protect state organizations in case of insurgency andto provide individual protection to government authorities.

Armed Forces

Subordinate to the Ministry of Defence, headed by General Raymond Georges, the armed forces(18,000) comprise: the Army, the Air Force, the Navy, and the Coast Guards. With the constant budget cuts, the defence forces suffer from logistic and maintenance shortfalls. About 60 percentof forces’ capabilities are unavailable for operational duty and the repeated delays in pays inducelow staff morale. Alphaland armed forces have no NRBC capability.

Risk assessment

Terrorist Activity Assessment

Two main terrorist organizations are present in Alphaland: The New Alphalandian Army (NAA)movement which claims for the establishment of an autocratic military regime. Led by exiled gen-eral Maruento, its members are mainly former armed forces personnel, highly disappointed by themilitary budget negligence. Well organized, assessed to be 400, they are equipped with light infan-try weapons which have been stolen.

The“Will of God Soldiers” (WoGS) is a religious movement led by fundamentalists who rejectall forms of modernity and want to return to traditional life with religious predominance. Providedwith foreign logistic supplies, they are assessed to be 700.

Organised Crime

The Mafia is involved in criminal activities. Kidnapping and drug smuggling represent its largestsource of income. ALPHALAND is described as a cocaine producing country and even govern-ment officials seem to be involved in the traffic.


15/89

15

The insecurity is increasing in ALPHALAND and organized gangs specialized in robbery withviolence are emerging (banks, supermarkets, private houses, car-jacking…). These groups arearmed with weapons ranging from assault rifles to anti-tank rockets and are reported to have at-tacked police stations and army depots in order to steal ammunition. They have close connectionswith the mafia.

Risks against foreign people/organizations

Many Alphalandians are against what they see as a foreign interference. Mafia contributes to feed-ing this anti-foreign feeling. In 2007, the visit of DELTALAND prime minister was marked byviolent demonstrations. The employees of foreign companies based in ALPHALAND are regularlythreatened. Consulates advise tourists against visiting the country.

General situation (actual scenario events)

Alphaland is an unstable country, governed by a weak and corrupted government. Itsmain resources are derived from agricultureand raw materials exploited by foreign companies. The population is essentially poor and

doesn’t benefit from the mining income thatgoes mostly into the hands of a few officials.Moreover, several thousands of Europeancitizen live in the country.

An earthquake occurred a few days ago in theReims region and the Alphaland governmentis unable to deal with all the consequences ofthe disaster. Facing destroyed infrastructure,

disrupted communication lines, growing sanitary problems and insecurity, the Alphaland govern-ment claims for international assistance. Bravoland and Charlyland, are not able to provide anyassistance to Alphaland.

The EU decides to deploy a DOB at Vouziers Airfield in order to perform a non-combatantevacuation operation from the disaster area to the capital city (Lille).

The theatre of operation remains under a ROTA (release other than by attack) CBRN threat and possibly limited terrorist attacks.

In addition, the EU has been asked to provide limited assistance to NGOs in order to facilitate theiraction to aid the Alphaland victims.

The threat

Terrorism consists of:

• Islamist local cells connected to internationals leaders,• Alphaland separatist trying to set up a coup in order to take power.Organized crime consists of local groups coming from “non rule of law areas”.

The ROTA CBRN threat consists of a damaged industrial chemical site threatening civilians.

Scenario materials include a number of maps, graphic charts and other resources.


16/89

16

Instability in a former communist country ruled by dictatorship with active extremist

groups affecting three neighbouring democratic countries

NATO Crisis Response Operation (CRO): Exercise BLUE GAME 2004 (BG04)

http://homepage.ntlworld.com/nigel.sadler1/page_article_Blue%20Game%202004.htm (unofficialsource / no official source could be found)

BLUE GAME 2004 is divided into phases starting with phase 1 (Harbour phase) 25-26 APR. Atthe harbour phase the participating units will familiarize with each other and get communicationequipment installed.

Phase 2 will be conducted from the 27 APR - 09 MAY with a weekend stay in harbour. Phase 2will focus on different warfares like Anti Surface Warfare (ASuW), Anti Air Warfare (AAW),Mine Counter Measures (MCM) and Anti Submarine Warfare (ASW). The participating forces aredivided into different Task Units depending ship capabilities. On completion of Phase 2, BLUEGAME will change to a Crisis Response Scenario (Phase 3) with asymmetric threats and the pro-tection of international shipping as the main focus areas. This scenario will be driven by aMEL/MIL-list which is different messages promulgated by the Exercise Staff to the participatingunits during that phase.

The scenario requires the execution of a primarily maritime NATO-led Multinational operationunder a UN mandate to reduce the terrorist threat in the area. It is the first time that BLUE GAMEwill be open for participation by partner nations. Sweden will take part and as a consequence Swe-den has accepted to open its territorial water.

Phase 3 will be terminated on 13 MAY and Phase 4 (HWU) on the 14 MAY will take place inDenmark where the exercise will analyse and discussed (lessons learned).

INTRODUCTION

The scenario for BLUE GAME 2004 (BG04) is totally fictitious and has no resemblance to anyreal world situation. It has been designed solely to support the exercise aims and objectives. Forthe benefit of the players five generic countries named STENSLAND, SCANDIA, SKAGIA, AN-GOR and The FEDERAL BALTIC STATES (FBS) have been created as depicted on the map.

GENERAL

STENLAND (ST), SKAGIA (SK) andSCANDIA (SC) are all democratic states,with a modern infrastructure within mostareas of the societies. Through the indus-trial evolution the three states have evolvedfrom relatively poor fishery and farmerstates to modern industrial countries takingactive part in all the important international

forums.The Republic of ANGOR is a formercommunist country that has turned into asort of past-communism dictatorship. The

elected President has changed the constitution in order to remain in power. The Parliament has been stripped of its powers and the marionette Government appointed by the President has neither been willing nor able to implement market economy. Hence the economical situation in ANGORhas deteriorated rapidly.

ANGOR’s former trading partners, in the vanished communist block, The FEDERAL BALTICSTATES (FBS) included, but also STENSLAND, SKAGIA and SCANDIA have turned their backto the country.


17/89

17

Political failures and grave financial hardship in ANGOR have led to a situation where severalfundamentalist groups have demanded extensive changes or a restoration to the old communist sys-tem. They argued that during this period people had work and veterans received their pensions.

The most extreme of these groups “The People of ANGOR Political Party” (PAPP) has on severaloccasions’ raided legal commercial trade shipments between the democratic countries in the regionand the rest of the world. Bombings and assassinations of politicians and industrial leaders have become a nearly daily event especially in East ANGOR. Other effects of the mismanagement ofthe nation are: illegal immigration, organised crime and smuggling. Today this situation also af-fects all the neighbouring countries. Especially, the ethnic “Angor enclave” in the Arendal area ofSTENSLAND, has become a PAPP stronghold on the northern side of the Skagerrak.

In addition, according to national intelligence sources the PAPP probably has several other sleep-ing operational groups known as the PAPPA’s (The PAPP Assault Groups) in both SKAGIA andSCANDIA.

SITUATION

On 10 July 2003 STENSLAND, SCANIA and SKAGIA implemented an economical embargoagainst ANGOR. Although initially discounted by the UN as political posturing, international con-

cern was raised when training and readiness stature of fundamentalist terrorist groups supportingANGOR became apparent. The International Society has also voiced concerns of the increasingnumber of refugees from ANGOR to STENSLAND, SKAGIA and SCANDIA.

Some elected democratic politicians still active in ANGOR have continued to condemn the funda-mentalist ideas within the ANGOR leadership. However, the Government has maintained strictcontrol of the opposition within the country. Some of the democratic elected politicians still activein ANGOR still try to voice their opposition, and stop the refugee flow out of the country and useevery opportunity to condemn the President’ fundamentalist ideas.

After the small boat suicide attack on the Spanish oil tanker M/T BERBERANA enroute SCAN-DIA from Mongstad (STENSLAND), in Skagerrak 22 Jun 03. Where M/T BERBERANA caughtfire, three of the crewmembers were killed and the tanker eventually sank. The UN Security Coun-cil Resolution 6401 was implemented. UNSCR 6401 condemns actions by the PAPPA’s and otherterrorist related groups in ANGOR, and advises the political leadership in ANGOR to take imme-diate action to bring the terrorist related group under control and gives NATO the lead of a Multi- National Maritime Force (MNMF) supporting STENSLAND, SKAGIA and SCANDIA to ensurefreedom of movement and protection for merchant shipping in the Skagerrak and Kattegat.

In East ANGOR some key commanding officers in the ANGOR military lately stated that they willno longer abide to the orders and directives passed from the regular military leadership in the capi-tal. Instead they intend to support the charismatic leader of PAPP Mrs Iva ISWOLF as their newCINC. Many people also support her demand for an Independent East ANGOR. This is all accord-ing to press reports, however if these statements are proven to be correct PAPP and the PAPPA’smight be in control of huge weapon arsenals, ranging from sea mines to airplanes.


18/89

18

Malicious attack scenarios

Nuclear material smuggling incident

Avoiding Catastrophic Terrorism: Lessons Learned in a U.S. and Russia Tabletop exercise

Nuclear Threat Initiative (NTI), November 2011

https://www.nti.org/media/pdfs/NTI_Tabletop_Report_FINAL.pdf?_=1323380823

The exercise used a plausible but fictitious scenario involving two seizures of kilograms of illicitlytransported nuclear material. Such quantities present the possibility that a sufficient quantity wasinvolved to create a nuclear bomb. The need for crisis management, in particular dealing with themedia, was central to the scenario as the seizures became known to the public. Given U.S. andRussian expertise and their extensive nuclear material holdings, bilateral cooperation would becritical in responding to a nuclear materials smuggling incident and is in both countries’ nationalsecurity interests. The scenario was designed to illuminate the issues and choices that U.S. andRussian officials would confront, to identify the advantages of and constraints on coordination andcooperation between the two governments, and to highlight actions that should be taken in advanceof such a contingency.

Procedurally, at specific points in the scenario (each phase), participants discussed the key issuesand responses. Participants were not playing specific roles, but rather served as advisors to theirrespective governments, drawing on their background and experience in nuclear weapons policyand technology as well as their experience with the news media. At the start of each phase, participants were provided information through a combination of “intelligence briefings,” informationfeeds, and simulated broadcast news segments. U.S. and Russian participants first met separately todiscuss each group’s initial perceptions and recommendations, and then met jointly to discuss these perceptions and appropriate actions. All information was presented in English and Russian, withsimultaneous translation of the discussion.

Phase 1: First 24 Hours

Based on highly credible intelligence, Russian and Tajik personnel intercept a shipment of eightkilograms of HEU metal on the Afghan-Tajik border and capture two suspects. On being interro-gated, the suspects claim that the material was en route to the United States and that two additionalshipments had already occurred. Russian personnel pass the facts of the seizure to their U.S. liaisoncounterparts. To help manage the situation, the scenario assumed that, at the end of the 24-hour period, the Russian and U.S. presidents create a Joint Action Group to assess and respond to theincident.

Phase 2: Days 2–4

Based on the initial Russian warning, one day after the seizure at the Afghan-Tajik border, U.S. Navy forces intercept a ship in the Mediterranean Sea and seize an additional eight kilograms ofHEU. Two captured suspects assert that the ultimate destination of the material was New York

City and claim that prior shipments had occurred. Within hours, the ship intercept is leaked to theU.S. media, and soon there are multiple media reports on television networks. The Joint ActionGroup meets to determine the source of the material, assess claims of additional material, manage public information, and consider responses.

Phase 3: After Two Weeks

After two weeks, both sides determine that the material did not come from the United States orRussia and most likely came from another weapons program. Coordination and technical chal-lenges, however, prevent a definitive assignment of responsibility, and nongovernment organiza-tions call for greater transparency and involvement of international organizations. Continued inter-rogation of the suspects indicates that their claims of having additional materials were not plausible. In response to this narrowly averted crisis, the Russian and U.S. presidents ask the Joint Ac-tion Group to develop a set of specific recommendations to facilitate future cooperation should anycomparable situation arise in the future.


19/89

19

Concerted cyber attack against the financial sector with significant disruption to pay-

ment services against the backdrop of the 2012 Olympic Games

UK Financial Sector Continuity: Market-wide Exercise 2011

http://www.fsc.gov.uk/section_file.asp?objectid=949&object=file&docid=2759$

The core of the scenario was a concerted cyber attack on the financial sector that impacted tele-communications, the internet and both wholesale and retail payments systems. The loss of CHAPS[Clearing House Automated Payment System] payments integrity within the member banks re-sulted in a suspension of wholesale payments across the sector and challenged organisations’ un-derstanding of alternative payment mechanisms, their liquidity management strategies and theirability to manage their business flows in response to the reduced capability of the payments infra-structure. On the retail side, organisations needed to be able to communicate quickly and effec-tively with customers to provide advice on alternative payment options. Ensuring the availabilityof cash from ATMs became an issue early in the scenario.

Organisations also needed to consider the extent to which they were liable to protect customersfrom, or compensate them for, costs arising from the payments disruption. The insurance compa-nies taking part had to consider how they would react to claims against policies that were not fullyfunded.

In order to further stretch participants, we chose 3 August 2012, likely to be the busiest day of the2012 Olympics, as the backdrop to the exercise. The main impact of this dimension was on theavailability of staff, which posed a significant challenge to organisations managing their humanresources so as to maintain close to business as usual service levels. Remote working strategieswere tested, as was the ability of organisations to maintain effective communications while staffwere dispersed.

Objective: Olympic planning and preparedness

To provide the opportunity for participants to assess their Olympic planning preparedness, in par-ticular the impact of a major disruption at the time of high staff absence.

The Olympics was chosen as the backdrop to the scenario and formed part of the crisis manage-ment element of the exercise. The scenario was developed to allow participants to test particularcomponents of their Olympic plan, including remote working capabilities at a time of high demandas well as the suitability of alternate/ recovery site provisions. Participants were also given the opportunity to test their evacuation procedures, including staff accounting procedures to deal with adisplaced workforce (some of whom could not be contacted due to mobile network saturation).Higher demands on internet usage leading to slower response times aimed to test participants’ re-mote working capabilities and organisations had to consider the criticality of those staff planningto work remotely during the Olympics and whether existing contingencies were sufficiently robust.

Key aspects of the scenario

•

The build-up to exercise day covered the period from the Olympics Opening Ceremony on27 July to 2 August 2012 in order to provide a detailed picture of how London’s transportsystem and the rest of the UK was coping with the Olympics in the context of the exercise.

• Terrorist threat level raised from ‘Substantial’ to ‘Severe’.• Exercise day (3 August 2012), the busiest day of the Olympics, opened with an unidenti-

fied explosion close to Bank station during the early morning rush hour (at 07:45) resultingin the declaration of a major incident and media speculation of there being a physical ter-rorist attack.

• Significant knock-on effects to the transport network and Olympic Route Network (ORN)caused longer than expected delays in public transport hotspots and resulted in staff beingunable to get to work on time (delays of more than one hour).

• Companies with premises outside London received a suspect package alert and had to in-

voke their evacuation procedures for staff.


20/89

20

• Between 60 to 80% (varying throughout the day) of home-working residential broadbandusers experienced issues with connecting to the internet (response times were three to fourtimes slower) due to increased usage and media streaming of the Games and coverage ofthe explosion at Bank. This in turn affected the ability of staff working remotely to connectto their offices.

• By 09:15, the cause of the explosion was confirmed as gas and the evacuation cordon was

extended to 200m, resulting in further buildings being evacuated.• At 13:00, the area was declared safe for re-occupation and the incident ‘stood down’.

Objective: Cyber and key suppliers

To explore and test dependence on key suppliers and in particular the internet and telecommunica-tions.

The scenario was based on targeting UK financial sector organisations’ systems and websites thatresulted in higher than average call volumes from affected customers. Failures in Point-of Sale(PoS) transactions were designed to test the retail sector’s ability to process card payments anddeal with increased cash demands. In addition a complete suspension of CHAPS had not been pre-viously addressed as part of a sector-wide exercise. As a result, integrity issues with CHAPS mem-

bers’ own payments systems were presented to encourage members to consider the implications ofa temporary suspension of payments, and alternative contingencies, while problems were investi-gated.

A key element of this was to use vulnerabilities or strains of a cyber attack that were new andcould not be immediately resolved so as to test an organisation’s response rather than its internalIT control frameworks.


• Abnormal levels of targeted phishing and sophisticated malware infections using new andunknown vulnerabilities to compromise organisations’ internal networks.

• A ‘call for action’ by a credible hactivist group and activist chatter concerning a mass Dis-

tributed Denial of Service (DDoS) attack on the financial sector in the week running up tothe busiest day of the Olympics.• Cyber threat level raised by CPNI warning of a potential attack on electronic systems.• DDoS attacks against UK financial services websites increase, affecting e-commerce, and

online payments are unable to complete transactions. This leads to customers seeking otherchannels to interact with organisations and overloading call centres as well as additionalworkload for IT support and operations staff.

• Broad attacks against multiple web domains associated with the UK financial sector, build-ing in tandem with the impacts of the explosion near Bank Station.

• About half of the UK’s PoS card transactions that require authorisation fail due to messagecommunication issues between acquirers and issuing banks, resulting in loss of confidence,increased demand for cash and pressure on ATMs during a time of restricted delivery op-

portunities.• CHAPS members individually notice anomalous payments and subsequent investigations

uncover similar problems with other members.

Objective: Strategic decision-making

To focus on strategic decision-making and include elements of financial stress/crisis to better en-gage senior executives.

Key aspects of the scenario at 13:00

• The incident close to Bank station had been stood down and the area was deemed safe bythe Emergency Services.

• Normal transport services had resumed and underground stations and the Olympic Route Network (ORN) had re-opened.


21/89

21

• Cyber attacks were ongoing as the website DDoS attack pattern had changed to becomemore sophisticated.

• UK online banking and insurance websites were still only able to service 20% of normalvolumes with most transactions failing or timing out. 60% of home workers across thecountry using residential broadband were still unable to maintain a satisfactory connectionto their offices.

• Acquirer networks were investigating the source of the DoS and DDoS attacks againstthem and Point-of-Sale issues were continuing.

• Cash deliveries scheduled for after 15:00 on exercise day were not expected to be made.• A further CHAPS Board call was scheduled for 14:30 to assess the ongoing situation (note

that this information was only available to CHAPS members as they had not advised indi-rect participants in the scheme of their earlier problems).

Objective: The return to Business as Usual

To determine how participants and the markets prioritise and manage the return to Business asUsual (BAU), following a major disruption.


To provide a common basis for participants to consider the return to BAU, the end status and reso-lution time for payments and Point-of-Sale (PoS) and Cash-in-Transit (CIT) issues were providedas follows:

• The business day was initially extended to 17:40 and then to 18:40 following a furtherCHAPS call with members.

• CHAPS members continued in contingency mode for the rest of the day but expected toresolve integrity issues over the weekend.

• A CHAPS Board call was scheduled for the Sunday evening to confirm a controlled startof payments on the Monday at 06:00.

• The Point-of-Sale issues were expected to be resolved over the weekend and transactionvolumes would return to normal over the next few days.

CIT providers expected to clear backlogs caused by the disruption by Monday evening and returnto normal schedules from Tuesday morning.


22/89

22

Series of targeted cyber attacks

US Department of Homeland Security, Office of Cybersecurity and Communications, NationalCyber Security Division: Cyber Storm III, Sept./Oct. 2010

http://www.dhs.gov/xlibrary/assets/nppd-cyber-storm-iii-final-report.pdf

SCENARIO OVERVIEW

During CS III, players responded to a series of targeted attacks resulting from compromises to theDomain Name System (DNS) and Internet chain of trust (i.e., validity of certificates and CertificateAuthorities [CAs]). Because of the reliance on DNS and the chain of trust for a wide range ofInternet transactions and communications, the adversary challenged players’ ability to operate in atrusted environment and support critical functions and trusted transactions. In addition, the adver-sary used these compromises to execute variety of targeted attacks against private-sector compa-nies, selected critical infrastructure sectors, public-sector enterprises, and international counter- parts. All exercise players felt effects created by the core scenario, and numerous IT/Comms, othersector, and Federal Government entities were heavily involved in resolving the situation. Overallresponse required significant communication and coordination per the NCIRP among a distributedand diverse player set.

The core scenario conditions allowed for the following targeted attacks to be played by a subset ofCS III participants:

Scenario Targets

• Widespread Service Update Compromise. The adversary compromised IT and communica-tions vendor service updates, leading to pervasive malware infections, phishing attacks, and animpending logic bomb. All exercise players experienced these conditions, and the majority ofIT/Comms Community players in the public and private sectors spent live exercise play evalu-ating potential remediation activities and interfacing with customers and constituents. Com-munication of effective resolution guidance proved to be vital as typical response and recovery procedures resulted in “bricking” of affected machines.

• Energy Management System (EMS) Compromise. Adversary compromise of EMS coding ledto control systems compromises and the triggering of a logic bomb on D-Day (Monday). Thelogic bomb severely limited system visibility and control, leading to grid reliability issues. Asthe compromise persisted, major impacts on the grid, including service disruptions, occurred.Compromises to the Energy Tagging and Trading System and customer-facing websites fur-ther complicated the response. The scenario resulted in robust play from private-sector provid-ers, EMS vendors, independent system operators (ISOs), and regulatory bodies.

• Chemical and Transportation Scenario Linkages. The adversary capitalized on core scenarioconditions to conduct attacks against chemical and transportation companies’ ordering systemsand customer-facing sites. Attacks affected production and transportation of goods. The sce-nario resulted in play for private sector chemical and rail companies, coordination bodies, andthe Government.

• Federal Scenario Linkages. The adversary used core scenario conditions to compromise con-nect.dhs.gov and a DHS “Chatter” account, conduct a spearphishing campaign, disrupt legiti-mate traffic through distributed denial of service (DDoS) attacks, compromise personal infor-mation of Government employees, and compromise customer information and financial data.Primary play occurred with DHS, Department of Transportation (DOT)/Federal Aviation Ad-ministration (FAA), Department of State, and the United States Postal Service (USPS).

• International Scenario Linkages. In Australia, the adversary used a series of compromises toinstitute sophisticated cyber command and control infrastructure extending across financial,energy, transport, water, government, and other critical sector systems. Attacks resulted in pri-vate-public coordination in Australia and some limited Usual 5 information sharing. In Can-ada, a massive web page defacement campaign followed by targeted malware distribution to

Government IT resources and ―Smart Phone‖ Enterprise Servers and the threat of attacksagainst control systems telecommunications assets prompted limited coordination, informationsharing, and communications among the Usual 5. Across the IWWN nations, propagation of


23/89

23

the Borders Worm led to massive exposure of sensitive data across political boundaries, dam-age to secure communications integrity, widespread outages, and bandwidth consumption.

• DoD/LE/I Scenario Linkages. A Defense contractor brought home a laptop (against policy)and plugged it back into the DoD information grid, leading to malware propagation. This ac-tion resulted in a compromise of the DoD military travel site, supply chain compromises ofunmanned aerial vehicles (UAVs), and severe network issues at a major international company

that supports the U.S. private sector and DoD (continental United States [CONUS]).• PA Scenario Linkages. As attacks affecting critical infrastructure sectors intensified, a journal-

ist contacted several companies regarding reports of cyber attacks and published a story on the National Cyber Exercise News Network (NCENN) citing specific companies and raising the public profile of attacks. In addition, various companies experienced disruption of public-facing websites, causing public imaging and communication concerns. NCENN publicized theattacks and linked events to prior investigative reports of cyber attacks and vulnerabilities, fu-eling public panic and widespread concern.

• States Scenario Linkages. The adversary targeted several states with attacks, focusing on dis-rupting constituent services and obtaining personally identifiable information (PII), in an at-tempt to create Government mistrust.

ADVERSARY OVERVIEWTo develop the CS III adversary, the Exercise Planning Team incorporated DHS Universal Adver-sary characteristics with real-world cyber threat elements. The simulated adversary operated as aloosely organized umbrella organization known as FdIE and united a diverse set of cyber capabil-ity groups to carry out large-scale and sophisticated attacks against Government, private-sector,and critical infrastructure targets. The combination of several distinct, advanced cyber attack capabilities created a uniquely qualified threat actor.

Per the exercise storyline, FdIE began as a small IT company in South America that went under-ground to provide illicit online services for malicious cyber activity. Individuals associated withthe mock organization had cyber attack capabilities that ranged from basic “for-profit” attacks toadvanced campaigns against critical infrastructure. FdIE gained experience by renting its services

to clandestine individuals and groups with malicious purposes. Players were told that in the past,FdIE rented services to hacktivist groups, organized crime groups, individual actors, and evenknown terrorist groups. As long as the group renting the service could prove that it was not associ-ated with law enforcement or the intelligence community and could provide the capital, FdIEwould accept its business. FdIE commonly hired other groups, using their specific capabilities tocomplete their contracts. In the past, they hired groups for malicious software development, exploitdevelopment, and other services.

FdIE’s founder was presented as a talented computer engineer with connections to the politicalelite and strong anti-Western sentiments. While undergoing normal recruiting operations, the foun-der contacted a series of capability groups with specialties in cryptography, application- and ser-vice-layer exploitation, and malicious software development, among others. The expertise of these

groups, in addition to FdIE’s expertise and connections to political elites, positioned FdIE to wagea potentially devastating attack on the United States and its allies.


24/89

24

Cyber attack on critical information infrastructure

European Network and Information Security Agency (ENISA): Cyber Europe 2010

http://www.enisa.europa.eu/activities/Resilience-and-CIIP/exercise-and-contingency-plans/cyber-europe/ce2010/ce2010report/at_download/fullReport

The exercise was structured around a scenario that included several incidents compromising theresilience of the Internet. The incidents affected all participating countries. The scenario of CY-BER EUROPE 2010 was developed to trigger communication between MS. The overarching ideadriving this scenario was an attack on critical assets that would impact all participating MS.

The main phases of the exercise were the following:

1. Discovery phase: i.e. to find points of contact in available directories, understand the exerciseset-up, etc.

2. Attack phase: i.e. several attacks against cross border Internet Interconnection Sites (IIS) totrigger the need for communication between Member States.

3. Recovery phase: i.e. problem resolution triggers the need for communication between MemberStates, in order to resume normal activity.

4. Wrap up phase: i.e. Member States are asked to issue a short report on cooperation activities.The overall scenario concentrated on the contingency phase after the attack since, in reality, themain actors involved during the initial stages of the attack would primarily be from the private sec-tor. The exercise did not attempt to simulate the actions of the private sector, nor did it attempt toengage participants in acting as the private sector. Accordingly, the scenario started at the point atwhich public bodies were involved, focusing on the public sector component of incident response.

The general theme of the scenario

In CYBER EUROPE 2010, experts worked together to counter simulated attempts by hackers to paralyse Internet Interconnection Sites (IIS) and critical online services in several European coun-tries. The topology of the IIS network was deliberately fictitious. The simulation was based on ascenario where Internet connectivity between European countries would be gradually lost or sig-nificantly reduced in all participating countries, so that citizens, businesses and public institutionswould find it difficult to access essential online services. In the exercise, Member States needed tocooperate with each other to avoid a simulated total network crash. The loss of Internet connec-tivity during the exercise is visualised by the maps below.

Scenario walk through

The main idea of the first phase of the exercise was to give players the basic information of thescenario, i.e. information that would be shared with the intelligence agencies of MS at a generallevel during the early stages of an incident. When the players received their first injects, they wereasked to try to find relevant contacts in and outside their countries. After 60 minutes, the ExerciseContact Book (ECB) was published. This led the CERTs to create a broadcast list in order to facili-

tate communication. The initiative to create a broadcast list is actually very close to ‘ordinary be-haviour’ and close to how CERTs usually operate, given their daily role in information sharing.Despite this proximity to their standard operating practices, it was an unexpected development.

The first link went down around 11.15 CET (see Figure 2), which led to a scenario peak between11.30-12.30. This period was the busiest in terms of scenario injects, since many communicationlinks were supposed to go down. However, by 11.30, players had already given a lot of feedback totheir MS-moderators. One could question whether the peak should perhaps have been scheduledfor later in the day in order to balance the players’ workload and to avoid lunchtime. It is neverthe-less important to bear in mind that the exercise was not a drill and hence players were not expectedto constantly have injects to react to. The baseline was that the goals of the exercise were to serveas a measurement of success, but not depend on the level of activity being maintained at a constanthigh. Furthermore, the fact that the pace of activity slowed down towards the end, because peoplehad completed their respective tasks, should be considered as positive.


25/89

25

A map of Europe’s Internet Interconnection Sites illustrated the chain of links that went down dur-ing the exercise. This map was only visible in the EXCON and each MS was only given a fragmentof the map (one map per country). The fact that no playing MS had the entire picture of Europe’sIIS, created a difficult task for each MS and stimulated the need for communication. The playersacted very cleverly and understood that in order to solve the situation they had to create their ownmap of Europe, since the problem clearly was not a local one.

Some of the players felt overloaded during this phase of the exercise, while others were familiarwith handling similar situations. The CERTs partly created additional pressure upon themselvesdue to the fact that they often tried to solve the problem at a level of excessive detail.

At approximately 12.30, an inject announced the upcoming meeting between European Heads ofState. The aims of this inject were i) to direct the players within each MS towards the developmentof a unified external message; and ii) to trigger them to write an official report. This proved to be avery useful task and stimulated those responsible for crisis coordination to draft an easily under-standable report, based on information gathered from their CERT community.

Some of the players thought that the afternoon was too calm due to the fact that the pace of injectshad decreased. This was, however, not a real problem from an exercise point of view. If the sce-

nario had occurred in real life, the players would also have had to deal with their ordinary tasks.Accordingly, it was important not to create so many different injects that they diminished the ‘real-ism’ of the exercise and, additionally, to leave some free time for the players to consolidate theirexperiences and observations, which were necessary for the exercise evaluation.

From a communications perspective, the exercise can be regarded a success, despite the fact thatmany players focused more on finding a technical solution to the problem, rather than on the com-munication with - and flow of information to/from - other participants. Players often requestedvery detailed technical information, although this could be explained by the fact that the CERTswould generally request this type of information in order to resolve issues at a technical level. It isimportant to note that the scenario and the injects were built around some challenging technicalissues. The fact that the players found ways of solving a problem of such a demanding nature is to be commended.

Scenario materials also include fictional situation maps.


26/89

26

Severe bioterrorist attack

Project on National Security Reform: Vision Working Group Report and Scenarios

Strategic Studies Institute, US Army War College, July 2010

http://pnsr.org/data/files/project_on_national_security_reform_vwg.pdf , pp. 37ff., pp. 79ff.

Scenario: Red Death Pre-National Security Reform

In this scenario, we meet a country struggling to get back on its feet after a major biological attackand witness a debate about the future role of the U.S. Government both at home and abroad.

Dr. Meishan Prosper, MD, ScD, cycled through the various web feeds of the inaugural StrengthThrough Unity Summit looking for anyone she knew. She assumed it would be unlikely, given thedeath toll over the last 3 years. The first response and medical communities had been the hardesthit, but no group of Americans had gone untouched. The word that was usually used was “deci-mated,” but she knew that decimated literally meant the death of 1 in 10 people. The Red Death,attacking the victims’ central nervous systems, had taken one quarter of the world’s population

seemingly overnight and left an addi

part2 scenario compilation css-bk

Documents