MG Stephen Gross (USAFR) NEER IPT Chair Deputy Director Deloitte & Touche Center for Cyber Innovation Using a Cloud Computing Model to Establish Net-Enabled Emergency Response (NEER) Core Services

1. Using a Cloud Computing Model to Establish
Net-Enabled Emergency Response (NEER) Core Services
NCOIC Cloud Computing Workshop
September 21, 2009
presented by
MG Stephen Gross USAFR
NEER IPT Chair
Deputy Director
Deloitte & Touche Center for Cyber Innovation

2. Recommendations for effectively
establishing NEER core services
 We will begin with our concluding recommendations
 Produce operational, capability and technical patterns for a
network-of-networks based on nationally defined, locally
implemented cloud computing storefronts hosting NEER
core services interfaced to local mesh networks
– Subscribe and Publish architecture
• Information is both “pushed” AHAW Logistics
and “pulled” alerts Digital
Geo- Rights
– Get the right information Spatial
SECURE,
Management
CLOUD-BASED
to the right people Data DISTRIBUTED
at the right time STOREFRONTS
Shared
up and down all for NETWORK CENTRIC OPERATIONS
chains of command
SUPPORTING PUBLIC SAFETY Directories
Identity and EMERGENCY RESPONSE CORE
SERVICES
– Focus on responder Management
Access
communities Mesh
Control
Networks
– Focus on victims Integration Broadband
Backbones
– “Everything Over IP”
Mobile
is fundamental
Responders Fixed
– Security as required Agencies
at all levels 2

3. Challenges to effectively
establishing NEER core services
 Balkanized control of emergency IT
– 120,000 ER jurisdictions in the
Public Safety/Emergency Responder
US alone, mostly small
COI (Non-Military) in the USA*
– Nearly as many in the EU/NATO/
allied European countries 20000
18000
 Lack of coordinated national,
16000 EOCs
provincial/state leadership Urgent Care
14000
 Stove pipe agency consumer 12000
Hospitals
solutions PSAPs
10000
– Dominance by vendors; land Public Health
8000 EMS
mobile radios prevalent
6000 Fire
 >$100 Billion in legacy systems
4000 Law
rarely designed to interoperate
2000
– >$1 Trillion worldwide
0
 Lack of widely available broadband Number of Agencies
infrastructure for emergency Source: and
responder COI 3

4. Challenges to effectively
establishing NEER core services (continued)
 Wisconsin State Patrol Chairman Casey Perry
attributed a great deal of his problems to
squabbles among states, counties and
municipalities. He said more federal grant
money needs to be conditional to
hold state and local governments
accountable for creating interoperable
networks
 "Each entity resists losing their share of
control," Perry said. "This is the underlying
root of the problems we face today."
4

5. Common requirements from multiple COI
not being effectively addressed today
 Standardized communications from and to any device, source
 Intelligence about people
– Responders and victims
– Secure when necessary
 Access to special resources
– People, e.g., interpreters, neurosurgeons,
mental health professionals, officials,
telecomm manager
– Things, e.g., hospital beds, specialized
vehicles, shelters, bulldozers, ambulances,
generators, cell sites
– Decision Support, e.g., predictive algorithms, geospatial
information, protocols, incident map, matching people to
shelters, directories
 Effectively addressing these requirements will require a national
establishment of NEER core services implemented nationally,
regionally and locally
5

6. What are NEER core services?
 NEER core services are those services necessary for full
information interoperability of the emergency responder
communities of interest for both day-to-day operations and
for response to complex humanitarian disasters
6

7. Agency locator
 Registration of all responders
– Identify who each emergency
responder is
– Identify each emergency
responder’s organization
– Describe organization type
• role-based access
– Define the incident types about
which each responder needs to
be alerted
• Jurisdiction based and/or
geographically based
• Help needed/wanted
• Just interested
– Define in advance where and to what devices each responder
wants calls and data sent
– Define in advance each responder’s radio frequencies, gateways,
CODECs, etc
7

8. Identity management
and access control
 Identify each information recipient
– Individual user and/or
organization
 How is each recipient represented
(Identifiers)
– Username, Log-in (Password,
PINs, Smartcards, Biometrics, etc
 Define how each recipient is to
be authenticated
– Validation of identifiers
 Describe what each recipient can
do when authenticated
(Authorization)
– What functions can be performed
– What data can be accessed
– Role-based – tied to identifiers – user and organization
 Define how each recipient will know the information
exchange is working properly
(Auditing) 8

9. Digital rights management
 Classification of data
– By data element, data
segment, entire record
 Granting of access rights
(informed consent)
– Permissions - what grantee is
allowed to do by action (access,
print, update, change, distribute,
etc.)
– Constraints - restrictions on the
permissions (i.e. cannot redistribute,
access granted only if tied to an
emergency, etc.)
– Obligations - what grantee has to
do/provide/accept
– Rights Holders - who is entitled to what
9

10. All hazards – all warnings
(AHAW) alerting
 Provide a practical, pragmatic methodology for efficient and
timely generation, authentication or confirmation and
distribution of emergency alerts and warnings
– Nationally mandated, integrated at the regional, state
and local levels
– Based on the latest version of the Common Alerting
Protocol (CAP) Standard from the Organization for
the Advancement of Structured Information
Standards (OASIS)
– Positions the use of CAP in a global system of
systems, network of networks, using a SOA which
will be reused in multiple NEER patterns
• The SOA which supports this set of patterns is based on the
Reference Model for SOA (SOA-RM)[RD/05], an OASIS standard
developed by the SOA-Reference Model Technical Committee (SOA-
RM TC) approved in March 2005
10

11. Examples of standards required for
NEER core services establishment
 Examples of NEER core services standards
MECI Demo / Sample Architectural Elements
(not an exhaustive list)
• SIP
•
Portable WiMax C2 appliances
CAP
• EDXL-DE, other emerging EDXL standards Cellular Comms Emergency
Kit
• Directory Services – EPAD Wireless and
Terrestrial Systems
SATCOM Gateway
IP Connectivity
(Voice, Video, Data)
• Wireless Mesh Networks – 802.11, 802.16
• Wireless Local Area Networks (LAN) – 802.11 Broken Links
• Connectionless Networking – IPv6 Restored link
IP Back-bone
Software Defined Radio
JTRS
• Connectionless Transport – UDP Sub-nets
• Connection-Oriented Transport – TCP, SCTP
• 3G cellular, both UMTS and CDMA2000
• Communications Security – IPSec, TLS, SCIP
• Satellite Communications – L band, Ku band
11

12. Recommendations for effectively
establishing NEER core services
 Produce operational, capability and technical patterns for a
network-of-networks based on nationally defined, locally
implemented cloud computing storefronts hosting NEER
core services interfaced to local mesh networks
– Subscribe and Publish architecture
• Information is both “pushed”
Logistics
and “pulled” AHAW
alerts Digital
– Get the right information Geo- Rights
to the right people Spatial
SECURE
Management
CLOUD-BASED
at the right time Data DISTRIBUTED
up and down all STOREFRONTS
Shared
for NETWORK CENTRIC OPERATIONS
chains of command SUPPORTING PUBLIC SAFETY Directories
– Focus on responder Identity and EMERGENCY RESPONSE
CORE SERVICES
communities Management
Access
Mesh
– Focus on victims Networks
Control
Broadband
– “Everything Over IP” Integration
Backbones
is fundamental Mobile
– Security as required Responders Fixed
at all levels Agencies
12

13. NEER core services
reference model
 Information  Services
– Facilitate knowledge – Enable KD&D through an
discovery and display (KD&D) open standards based service
by making information from oriented architecture that is
all core services storefronts • Secure as needed
• Accessible • Highly scalable
• Understandable KD&D CORE SERVICES • Highly distributed
• Trustable • >99.9% available
AGENCY LOCATOR
• Interoperable – No single points of failure
• Manageable • Decentralized for administration
IDENTITY MANAGEMENT
RIGHTS & PERMISSIONS
ALL HAZARDS ALL WARNINGS
CLOUD STOREFRONTS
STANDARDS
TRUSTED NETWORKS
13

14. NEER Contacts
 Please direct all inquiries regarding the NCOIC
Net-Enabled Emergency Response initiative to:
– Stephen Gross
NEER IPT Chair
+1.202.879.5678
stgross@deloitte.com
Please copy:
– Paul Mangione,
Senior Technical Staff
+1.253.839.3395
paul.mangione@ncoic.org
14