Operational Working Group SEESIM 14 Main Planning Conference

Operational Working Group SEESIM 14 Main Planning Conference (MPC) 31 st March – 5 th April 2014 Zagreb, Croatia Co-Chairs LTC Ana Hajdić LTC Petar Vrategov UNCLASSIFIED 1

Operational Working Group SEESIM 14 Introductions Please add your name and contact information to the Op. WG contact list UNCLASSIFIED 2 2

MPC Operational WG Objectives SEESIM 14 Ø Review and update Manning Document Ø Review and refine Exercise design Ø Refine National Scenarios and Training Objectives Ø Discuss Training Audience Workshops Ø Review Exercise floor plans Ø Review Exercise planning and execution timeline Ø Develop daily Exercise Operational Schedule Ø Review and update POA&M UNCLASSIFIED 3

MPC Operational WG Objectives SEESIM 14 Ø Review and discuss draft Information Management Plan Ø Conduct MEL/MIL Development Workshop #2 Ø Finalize Exercise Specification (EXSPEC) Ø Identify names for Site Managers and AAR Analysts Ø Determine Operational Working Group objectives for the FCC Ø Identify and discuss any remaining Operational Issues Ø Draft Operational Working Group minutes UNCLASSIFIED 4

Manning Document SEESIM 14 • Exercise Control (EXCON) – Operational Personnel (includes all Response Cells) – Technical Personnel – Determine required billets at IPC – Provide names at FCC • Training Audience – Personnel in Emergency Operations Centers (EOCs) and SEEBRIG HQ – Determine required billets at IPC – Provide names at FCC UNCLASSIFIED 5

EXCON Forward Site Managers SEESIM 14 EXCON Forward Name Albania Mr Xuvanag Gjylameti Bosnia and Herzegovina Mr Željko Dugonjić Bulgaria COL Nikola Stoyanov Croatia Montenegro Romania SEEBRIG HQ LTC Jetnor BALLA the former Yugoslav Republic of Macedonia* * Turkey recognizes the Republic of Macedonia with its constitutional name UNCLASSIFIED 6

EXCON Forward AAR Analysts SEESIM 14 EXCON Forward Name Albania LTC Adrian Djokoli Bosnia and Herzegovina LTC Ibro Alispahić Bulgaria MAJ Boncho Boncev Croatia Montenegro Romania SEEBRIG HQ MAJ Anastasios STRATIS the former Yugoslav Republic of Macedonia* * Turkey recognizes the Republic of Macedonia with its constitutional name UNCLASSIFIED 7

SEESIM 14 Timeline SEESIM 14 Jan Feb Mar Apr May Jun Jul Aug Sep Oct Nov Dec Apr May Jun 2013 Bilateral 19 -21 Croatia ESC 24 -27 Croatia Feb Jan Mar IPC 21 -24 Croatia 2014 Jul MPC 2 -5 Croatia Aug Sep Setup/Trg 1 -19 Croatia FCC 3 -5 Croatia Oct Nov Dec Execution 23 -26 Croatia UNCLASSIFIED 8

Training Seminars, Workshops SEESIM 14 Jan Feb Mar May Jun 2014 Apr EPC 31 -1 CMC 26 -27 Jul Aug • IBC • 28 -31 Sep IBC = International Border Crossing EPC = Exercise Planners Course CMC = Crisis Management Course UNCLASSIFIED 9

SEESIM 14 Execution Schedule (Sep 14) SEESIM 14 MON TUE WED THU FRI SAT SUN 1 2 3 4 5 6 7 9 10 11 12 13 14 20 21 Travel EXCON Main Travels to Croatia 27 28 Comms Hot (All sites) 8 Travel 15 SM & AAR Training 16 17 18 Travel EXCON Main Training 29 23 Opening 19 End-to-End Test Final Setup and Testing 22 Travel 24 JCATS Training 25 DV Day Execution 26 AAR Closing EXCON Main Travels Home 30 UNCLASSIFIED 10

SEESIM 14 Operational WG SEESIM 14 Daily Operational Schedule LTC Ana Hajdić Croatian Mo. D LTC Peter Vrategov Bulgarian Mo. D UNCLASSIFIED 11

Recommendations from SEESIM 12 SEESIM 14 • Daily operational rhythm is too intensive • Decrease the number of exercise days - Exercise execution should not be more than 7 days • Begin the White Cell meeting 30 minutes prior to stoppage of exercise play instead on one hour prior UNCLASSIFIED 12

Exercise Execution Times SEESIM 14 0800 – 1600 0900 – 1700 Albania Bosnia and Herzegovina Croatia Montenegro the former Yugoslav Republic of Macedonia* Bulgaria Romania SEEBRIG HQ * Turkey recognizes the Republic of Macedonia with its constitutional name UNCLASSIFIED 13

Daily Operational Schedule SEESIM 14 Time Event POC Transportation to the Military Academy All Begin Exercise Play All MEL/MIL Synchronization Meeting (VTC) MEL/MIL 1100 AAR Observer Daily Report Due AAR 1300 White Cell Meeting Slides Due EXCON White Cell Meeting (VTC) EXCON End Exercise Play All Transportation to Hotel All 0715 -0745 0800 0900 -1000 1530 -1600 1630 -1700 • Note – all times are local Zagreb, Croatia time • Daylight Savings Time (DST) ends on October 28 in Europe UNCLASSIFIED 14

Plan of Action & Milestones (POA&M) SEESIM 14 Dates Task POC Status DRAFT EXSPEC Document Ops Group COMPLETED Exercise Specification Conference (ESC) All COMPLETED 15 Dec 13 Install JEMM server in Croatia HN COMPLETED 15 Dec 13 Create JEMM accounts HN COMPLETED 21 Dec 13 Updated EXSPEC Document Ops Group COMPLETED 17 Jan 14 Identify billets in Manning Document All COMPLETED 21 -24 Jan 14 Initial Planning Conference (IPC) All COMPLETED 22 -23 Jan 14 MEL/MIL Development Workshop Ops Group COMPLETED 2 -4 Apr 14 Develop Scenario (Road to Crisis) Ops Group ONGOING 2 -5 Apr 14 Main Planning Conference (MPC) All ONGOING 2 -3 Apr 14 MEL/MIL Development Workshop Ops Group ONGOING 26 Apr 14 DRAFT Exercise Control Plan Ops Group 26 Apr 14 DRAFT Exercise Manning Document All 26 Apr 14 DRAFT EXCON Training Plan Ops Group 25 Aug 13 24 -27 Sep 13 UNCLASSIFIED 15

POA&M (cont. ) SEESIM 14 Dates Task POC 26 Apr 14 DRAFT EXCON Architecture, Floor Plans Ops Group 26 May 14 Final Information Management (IM) Plan Info Manager 3 Jun 14 Identify names for Manning Document All 3 -6 Jun 14 Final Coordination Conference (FCC) All 15 Jun 14 Updated Exercise Manning Document All 15 Jun 14 Final Exercise Control Plan Ops Group 15 Jun 14 Updated EXCON Training Plan Ops Group 15 Jun 14 Final EXCON Architecture, Floor Plans Ops Group 15 Jun 14 Final EXSPEC Document Ops Group 1 Sep 14 Comms “Hot” to All Sites Tech Group 15 -31 Aug 14 Equipment Installation in Croatia Tech Group 4 -5 Sep 14 Technical Training in Croatia Tech Group 8 -12 Sep 14 Remote Site Installations and Testing Tech Group 9 -11 Sep 14 Site Manager and AAR Training in Croatia SM / AAR UNCLASSIFIED Status 16

POA&M (cont. ) SEESIM 14 Dates 15 Sep 14 Task POC Final Collection Management Plan (CMP) AAR 15 -17 Sep 14 Final Setup and Testing Tech Group 18 -19 Sep 14 End-to-End Test Tech Group 18 -19 Sep 14 JTLS Training Tech Group 22 Sep 14 EXCON MINIEX All 22 Sep 14 EXCON Main Training All 23 -26 Sep 14 Exercise Execution Status All 26 Sep 14 Distinguished Visitor (DV) Day All 26 Sep 14 Post Exercise Hotwash All 26 Sep 14 After Action Review (AAR) AAR 26 Sep 14 Closing Ceremony All 12 Oct 14 First Impressions Report (FIR) AAR 26 Dec 14 Final Exercise Report (FER) AAR UNCLASSIFIED 17

SEESIM 14 Operational WG SEESIM 14 Exercise Design LTC Ana Hajdić Croatian Mo. D LTC Peter Vrategov Bulgarian Mo. D UNCLASSIFIED 18

SEESIM 14 Participants SEESIM 14 • EXCON MAIN CROATIA UNCLASSIFIED 19

International Organizations SEESIM 14 Invitation sent out on 21 February 2014 to: • NATO Euro-Atlantic Disaster Response Coordination Centre (EADRCC) • European Police (EUROPOL) • Emergency Response Coordination Centre (ERCC) – (Former EUMIC) • International Federation of Red Cross and Red Crescent (IFRCC) • International Police (INTERPOL) • United Nations Office for the Coordination of Humanitarian Assistance (UNOCHA) • World Health Organization (WHO) UNCLASSIFIED 20

SEESIM 14 Exercise Design SEESIM 14 UNCLASSIFIED 21

Exercise Architecture -Chart cont. EXCON Organizational SEESIM 14 Exercise Director Deputy Exercise Director Visitor Observers Bureau (VOB) Public Information Center (PIC) Personnel located in Croatia and remote sites EXCON Director EXCON Admin Operations Group Technical Group Operations Officer Technical Coordinator Information Manager Systems Technicians (One per Exercise site, plus EXCON Main techs) Scenario Manager Comm Technicians (One per Exercise site, plus EXCON Main techs) MEL/MIL Trackers Liaison Officers (One per Exercise site, all located in Croatia) After Action Review Mgr AAR Analysts International Organizations VTC Bridge Operator VTC Operators (One per Exercise site) JCATS Tech Controller (One per Exercise site) Database Manager Sr Model Controller (TBD) Site Mgrs / Role Players JCATS Operators UNCLASSIFIED (One per Exercise site, all located in Croatia) 22

Exercise Control (EXCON) Organization SEESIM 14 • EXCON • Director EXCON Main (Croatia) LTC Hajdić CPT Prebeg • Operations • Chief • Scenario • Manager MAJ Mauhar • MEL/MIL • National Event • Managers • Technical • Coordinator • AAR • Manager • Sub-Regional • Event Manager • LNOs • Site • Managers • MEL/MIL • Trackers LTC Lokas • CAX • Manager CPT Hemetek CPT Štefanec • Database Manager • JTLS Tech Control • SITFOR Remote Sites • AAR • Analysts UNCLASSIFIED • JTLS • Operators • Role • Players 23

SEESIM 14 EXCON Main Floor Plans LTC Ana Hajdić SEESIM 14 Operational WG UNCLASSIFIED 24

Exercise Facility Floor Plan SEESIM 14 Croatian Defence Academy (CDA) Zagreb, Croatia National Response Cells Exercise Directors Protocol Scenario EXCON Main Liaison Officers EXCON Operations After Action Review Info Management JCATS Model Control International R/C • 21 • 22 • 11 • 23 • 10 • 51 Real Life Support • 24 • 9 • 7 Admin Room Internet Cafe • 31 • 4 Tech Ops VTC Bridge Main Entrance Building 58, South Wing - Ground Floor UNCLASSIFIED

SEESIM 14 Exercise Specification (EXSPEC) UNCLASSIFIED 26

SEESIM 14 Questions ? UNCLASSIFIED 27

SEESIM 14 Scenario and Road to Crisis Co-Chairs CPT Višnja Prebeg LTC Hristo Atanasov SEESIM 14 Scenario Managers UNCLASSIFIED 28

Overview SEESIM 14 • Seven nations and SEEBRIG participating • Each nation experiences a number of natural or man made disasters in their nation or a subregional incident in which they chose to participate • Each nation will manage the consequences of each disaster as well as offering and accepting assistance from neighbors and nations in the region UNCLASSIFIED 29 29

Structure for Injects SEESIM 14 Event-Sub-regional or Nation • Inject • Inciden t • Inject • Event • Inject • Inciden t • Inject UNCLASSIFIED 30 30

SEESIM 14 Sub-Regional and National Events and Incidents UNCLASSIFIED 31 31

Sub regional events SEESIM 14 Total number of events : 5 • 1. Earthquake: Romania/Bulgaria/SEEBRIG • 2. Flooding: Bi. H/Croatia • 3. Flooding: FYROM*/ Bulgaria • 4. Chemical Incident: Croatia/ Bi. H • 5. Airplane crash: Croatia/Montenegro • 6. Cyber attack: All coutries experiencing CA * Turkey recognizes the Republic of Macedonia with its constitutional name UNCLASSIFIED 32

National Events/Incidents SEESIM 14 Total number of events/incidents : 7/10 • 1. Albania 1. 1 Flooding 1. 2 Earthquake • 2. Bosnia and Herzegovina 2. 1 Cyber Attack 2. 2 Forrest Fire • 3. Bulgaria 3. 1 Flooding • 4. Croatia 4. 1 Earthquake 4. 2 Cyber attack UNCLASSIFIED 33

National Events/Incidents SEESIM 14 • 5. FYROM* 5. 1 Cyber attack • 6. Montenegro 6. 1 Earthquake • 7. Romania 7. 1 In flight terrorist attack/cyber attack * Turkey recognizes the Republic of Macedonia with its constitutional name UNCLASSIFIED 34

Sub regional event No. 1 SEESIM 14 • Name - Earthquake • Involved countries-Romania /Bulgaria/SEEBRIG • Lead Nation-Romania • Training objectives TO 1 - coordinate disaster relief and assistance to regions and population that is affected by a sudden calamity that has brought great damage, loss or destruction TO 2 - coordinate measures during, and after natural disasters to reduce probability of damage, minimize its effects, and initiate recovery ROU - TO 1 - enhance cooperation among national agencies, regional and international organizations with responsibilities in emergency situation management - TO 2 - exercise national procedures and coordination actions alongside neighboring countries during natural disaster BLG- TO 1 - exercise national procedures and enhance cooperation among national agencies, and arrange for provision of relief perssonnel and supplies to the disaster area. SEEBRIG HQ - TO 1 standardize and improve command control processes and procedures for coordination of assistance in disaster response operations - TO 2 improve cooperation and coordination with organizations specialized in civil emergency response - TO 3 standardize and improve processes and procedures of SEEBRIG ETF/CEC for reacting to emergency situations Scenario-storyline: On 23 Sept 14, 10. 05, in România is produced an earthquake measuring 7. 4 on the Richter scale. The earthquake affected south part of Romania and north part of Bulgaria and produce many victims, and infrastructure damage beyond the national capabilities to respond. SEEBRIG ETF can support the national engineer task force of Romania. UNCLASSIFIED 35

Sub-regional event No. 1 Location SEESIM 14 Time: on 23. September 2014 Earthquake between Romania and Bulgaria UNCLASSIFIED 36

Sub regional event No. 2 SEESIM 14 • Name: Flooding • Involved countries: Bosnia and Herzegovina, Croatia • Lead Nation: Bosnia and Herzegovina • Training objectives: • Sub regional EOC coordination IAW bilateral agreement btw countries • • • Develop Multinational Intelligence / Information Sharing Structure Coordinate Disaster Relief Provide for En-Route Support and Clearances Disseminate and Integrate Operational Intelligence Establish Disaster Control Measures • Scenario-storyline: After heavy showers level of the Jablanica lake raises very fast. Institutions of BIH are forced to open the damns. Consequence is that the villages south from Mostar are flooded and there is a threat of flooding to the Metkovic city in Croatia. Emergency Operational Centre of Bosnia and Herzegovina and Croatia will constantly exchange information about situation development in a valley of river Neretva and accordingly will seek help from UNCLASSIFIED Croatia. 37

Sub-regional event No. 2 Location SEESIM 14 Time: on 25. September 2014 Flooding affected Croatia and Bosnia and Herzegovina (Metković) UNCLASSIFIED 38

Sub regional event No. 3 SEESIM 14 • • 1. Name - Flooding in the Strumitsa region Involved countries – Bulgaria/the Former Yugoslav Republic of Macedonia* Lead Nation – the Former Yugoslav Republic of Macedonia* Training objectives Provide for En-Route Support and Clearances 2. Coordinate Disaster Relief 3. 4. • Establish Disaster Control Measures Test possibilities for bilateral EOC coordination & cooperation Scenario-storyline: The region of the municipality Strumitsa, after the heavy rains that have been falling for two days, the town and the settlements in the Strumichko Pole have been flooded. In the early morning hours there is a spillover of the Turija dam, and the flood wave with a West direction pours out of the bed of the Strumitsa river continuing close to the border with Bulgaria. The destruction caused by the flood is beyond the capability of national resources to respond, and a call for aid is required. * Turkey recognizes the Republic of Macedonia with its constitutional name UNCLASSIFIED 39

Sub-regional event No. 3 Location SEESIM 14 Time: on 23. September 2014 Flooding affected FYROM* and can affect Bulgaria (Strumitza Region) * Turkey recognizes the Republic of Macedonia with its constitutional name UNCLASSIFIED 40

Sub regional event No. 4 SEESIM 14 • • • Name: Chemical Incident in Okučani Involved countries: Croatia, Bosnia and Herzegovina Lead Nation: Croatia Training objectives: 1. Subregional EOC Coordination 2. Establish Disaster Control Measures 3. Provide Support for Humanitarian Assistance Story line: A cargo/tanker train collides in Okučani railway station causing the leackage and widespreading of Amoniac. UNCLASSIFIED 41

Sub-regional event No. 4 Location SEESIM 14 Time: on 25. September 2014 Chemical incident in Croatia, Bi. H involved (Okučani) UNCLASSIFIED 42

Sub regional event No. 5 SEESIM 14 • • Name : Airplane crash near Dubrovnik Involved countries: Croatia, Montenegro Lead Nation: Croatia Training objectives HRV: 1. 2. 3. 4. • Training objectives MNG: 1. 2. • Plan and Conduct Search and Rescue (SAR) mission between RCC (Rescue Coordination Centre) Coordination of Croatia SAR activities Coordination of Montenegro SAR activities Disseminate and Integrate Operational Intelligence between SAR forces of Croatia and Montenegro Plan and conduct Search and Rescue (SAR) mission if requested by Croatian authorities and in coordination with Croatian Rescue Coordination Centre (RCC) Coordination of SAR activities within Montenegrin institutions Story line: An Aircraft with CRO/MNE passengers crashes in Southestern part of the Republic of Croatia in a vicinity of Montenegro border. UNCLASSIFIED 43

Sub-regional event No. 5 Location SEESIM 14 Time: on 23. September 2014 Airplane crash in Croatia, Montenegro involved (Dubrovnik) UNCLASSIFIED 44

Sub regional event No. 6: Cyber • • SEESIM 14 Name: Cyber Involved countries: All experiencing a cyber-attacks Lead Nation: Croatia (HN for SEESIM 14) Training Objective(s): – TO #1: Cross-Boundary Sharing of Cyber Defense Information • Training Audience: EOCs • Stimuli/Prompt: Ongoing Cyber-Attacks • Activities: As each country EOC receives information/reporting from their Cyber Defense assets (e. g. CERT), they provide information to other EOCs about the Cyber. Attack they experienced (e. g. Denial of Service, data destruction, etc…) and recovery methods • Performance Metric: YES or NO within 24 hours of event • Method(s): Coordination with adjacent EOCs as required • Story Line: As events in the region unfold, unattributed hackers decide to worsen the situation by conducting denial of service attacks against Internet Exchange Points (IXP) and/or Internet Service Providers (ISP) across the region. This results in degraded internet connectivity across the region reducing effectiveness of response efforts. Note: these attacks appear to be focused nationally at first, but the signatures of the attacks indicate a coordinated effort to disrupt internet capabilities across the region. UNCLASSIFIED 45

Sub-regional event No. 6 Location SEESIM 14 Times: on 23. September 2014 Cyber attacks in Croatia, Bi. H , Romania and Macedonia) UNCLASSIFIED 46

Event No 1: Albania SEESIM 14 Incident No 1: Flooding • Training objectives Standardize and improve national and regional processes and procedures in emergency response; improve interoperability Practice and improve information management and flow procedures between and within the Emergency Operations Centres (EOCs), as well as standardization and interoperability of process and procedures; Storyline: Heavy rain and melting snow have caused heavy flooding in western Albania affecting the Drini, Gjadri, and Buna rivers. this has caused overflowing of the rivers and putting into danger the dams of the Hydropower's that are built in this rivers. The weather forecast shows that for the next ten days is rain in the southern parts of Albania, with snow in the northern and higher elevations. The perfect of Shkodra has informed the Ministry of Interior for the situation and the assessed damage that is caused in the area. The damage is assessed that 8 communes are totally under water, 1200 houses are flooded and 450 families need urgent evacuation, a number of animals are dead and flouting in the waters. Proposed by the Minister of Interior, the Prime Minister declares the natural disaster for the Shkodra prefecture and calls the National Comity for Civil Emergencies. Albanian may be asking help from the neigbouring countries. UNCLASSIFIED 47

Event No 1: Albania SEESIM 14 Incident No 2: Earthquake • Training objectives • • • Enhance interoperability and coordination of crisis response operations in a multinational environment; Enhance mutual understanding and trust between the participating countries; Encourage the development and interconnection of national simulation capabilities to enable multinational operations through a common communications network; • Storyline: One series of earthquakes with magnitude 5. 0 Mw, with an epicenter near the town of Elbasan, approximately 35 kilometers of Tirana capital, has happened during the last 72 hrs. At least 52 afteshoks measuring 4. 5 or greater had been recorded. An estimated 30 000 people were affected by the quake. No death toll is estimated. The government of Albania estimates that 5, 000 residences and 1, 000 comercial buldings are collapsed or are severely damaged. The earthquake has caused major damage in the City and other settlements in the region. Many buildings are significantly damaged or destroyed, including the Mayor building, the fortress in the city center. A big number of buildings located in the suburb, collapsed, killing many animals, those which are saved are running of the open fields causing confusion and making people fight for their property. Communication systems, land transportation, hospitals, and electrical networks had been damaged by the earthquake. The population is in fear and is out on the open sky and need immediate evacuation and sheltering. Damaged houses are subject of harming people. Abandoned house are being subject of burglary that 48 has made their owner difficult to evacuate. UNCLASSIFIED

Event No 2: Bosnia and Herzegovina SEESIM 14 Incident No 1: Cyber Attack • Training objectives : • Coordinate Information Assurance (IA) Procedures • Assist in Combating Terrorism • Storyline: At the International airport in Sarajevo, which is currently closed due to dense fog, the weather service from the airport flight control reported problems in the use of equipment and computers. Experts are invited to identify the problem. Information is received that hacker attacks were carried out on computer systems. UNCLASSIFIED 49

Event No 2: Bosnia and Herzegovina SEESIM 14 Incident No 2 : Forrest Fire • Training objectives: • • Coordinate Disaster Relief Establish Disaster Control Measures Provide for Movement Services in Area of Operations Provide Support for Humanitarian Assistance, Disaster Relief, and Civil Military Cooperation • Storyline: After long period without rain on southeastern part of Bi. H fires started in Jablanica and Trebinje. Fires put houses and people in danger. UNCLASSIFIED 50

Event No. 3: Bulgaria SEESIM 14 Incident No 1: Flooding • Training objectives: 1. Coordinate movement of equipement, fuel, supplies and personnel supplies necessary to sustain operations and to provide transportation resources for moving the forces that execute those operation 2. Update specific operating procedures, improve coordination between governmental and international organizations to respond to the disaster • Storyline: Due to continuous heavy rains, high waters of rivers Tundzha and Maritza have caused serious floods along their valleys UNCLASSIFIED 51

Event No. 4: Croatia SEESIM 14 Incident No 1: Earthquake near Makarska • Training objectives: 1. 2. 3. 4. 5. Establish Disaster Control Measures Coordinate Disaster Relief Coordinate Support for Forces in the Joint Operations Area (JOA) Provide Support for Humanitarian Assistance, Disaster Relief, and Civil Military Cooperation Provide for En-Route Support and Clearances • Storyline: Earthquake (magnitude 8 by Richter scale) in the vicinity of Makarska cause large number of casualties (indigenous and tourists) and severe damage to the infrastructure. UNCLASSIFIED 52

Event No. 4: Croatia SEESIM 14 Incident No 2: Cyber Attack on Internet Exchange Points • Training objectives: – – Protect Theatre Information Systems (INFOSYS) Request Cyber Defense Support Employ Theatre Computer Security (COMPUSEC) Identify IXP and/or Internet Service Providers (ISP) • Story Line: As events in the Croatia unfold, unattributed hackers decide to worsen the situation by conducting denial of service attacks against Internet Exchange Points (IXP) and/or Internet Service Providers across the country. This results in degraded internet connectivity across the Croatia reducing effectiveness of response efforts. UNCLASSIFIED 53

Event No. 5: FYROM* SEESIM 14 Incident No 1: Cyber attack • Training objectives: • Employ Theatre Computer Security (COMPUSEC) • Assist in Combating Terrorism • Check coordination between different national institutions & identify weaknesses • Scenario-storyline: From unidentified cyber location, the system for communication, observation and tracking (COAT) is blocked. * Turkey recognizes the Republic of Macedonia with its constitutional name UNCLASSIFIED 54

Event No. 6: Montenegro SEESIM 14 Incident No 1: Earthquake • Training objectives: • • • Training objective 1: • Engagement of civilian institutions in disaster control and disaster relief Training objective 2: • Coordination of activities on national level between civilian and military counterparts in case if capacities of civilian institutions are overwhelmed Training objective 3: • Coordination of international assisstance Storyline: Strong earthquake over 6 degrees of the Richter scale struck the area 5 km southwest of the municipality of Danilovgrad causing many victims, injured people, and severe infrastructure damage in Danilovgrad and Podgorica. There is a big possibility that civilian emergency responders’ capacities will be overwhelmed and there might be request for military and international assistance. UNCLASSIFIED 55

Event No. 7: Romania SEESIM 14 Incident No. 1: In-flight terrorist attack on a Romanian civil aircraft flying from a non-SEDM country and cyber attacks on air space recon and surveillance systems • Training objectives: - TO 1 - Exercise effective protective measures taken to prevent, deter, and respond to terrorism and cyber attacks - TO 2 -To employ wide application of hardware, firmware and software security features to a computer system in order to protect against, or prevent, the unauthorized disclosure, manipulation, modification or deletion of information or denial of service - TO 3 - Update specific operating procedures, improve coordination between governmental and international organizations to respond to treats associated to terrorist organizations UNCLASSIFIED 56

23 - 26 September 2014 SEESIM 14 Scenario Timeline UNCLASSIFIED 57 57

23 September 2014 (3 of 5) and (6 of 10) SEESIM 14 Sub-Regional 1. Earthquake: Romania/Bulgaria/SEEBRIG (23 to 26 SEPT) 3. Flooding: FYROM*/Bulgaria (23 to 25 SEPT) 5. Airplane crash: Croatia/Montenegro (23 to 25 SEPT) National: 2. Bosnia and Herzegovina 2. 1 Cyber attack (23 to 25 SEPT) 2. 2 Forrest Fire (23 to 23 SEPT) 4. Croatia 4. 1 Earthquake (23 to 25 SEPT) 4. 2 Cyber attack (23 to 23 SEPT) 6. Montenegro 6. 1 Earthquake (23 to 26 SEPT) 7. Romania 7. 1 Terrorist attack (23 to 26 SEPT) * Turkey recognizes the Republic of Macedonia with its constitutional name UNCLASSIFIED 58 58

24 September 2014 (3 of 10) SEESIM 14 National: 1. Albania 1. 1 Flooding (24 to 26 SEPT) 3. Bulgaria 3. 1 Flooding (24 to 26 SEPT) 5. FYROM* 5. 1 Cyber attack (24 to 24 SEPT) * Turkey recognizes the Republic of Macedonia with its constitutional name UNCLASSIFIED 59 59

25 September 2014 (2 of 5) and (1 of 10) SEESIM 14 Sub-Regional 2. Flooding : Bosnia /Croatia (25 to 25 SEPT) 4. Chemical incident: Croatia/ Bosnia (25 to 26 SEPT) National: 1. Albania 1. 2 Earthquake (25 to 26 SEPT) UNCLASSIFIED 60 60

Timeline Sub-Regional Incidents (JEMM? ) SEESIM 14 Earthquake (Romania, Bulgaria, SEEBRIG) Flooding (FYROM*, Bulgaria) Chemical incident Incident (Croatia, Bosnia and Herzegovina) Airplane Crash (Croatia , Montenegro) 23 SEP 24 SEP 25 SEP 26 SEP Flooding (Bosnia and Herzegovina, Croatia) Cyber Attacks (Croatia, FYROM*, Bosnia and Herzegovina, Romania) UNCLASSIFIED *Turkey recognizes the Republic of Macedonia with its constitutional name. 61 61

Timeline National Incidents (JEMM? ) SEESIM 14 Albania: Flooding in Shkodra Region Earthquake in Elbasan Bosnia and Herzegovina: Cyber attack Forrest Fires in Jablanica and Trebinje Bulgaria: Flooding Tundza and Maritza Rivers Croatia: Cyber attack Earthquake near Makarska the former Yugoslav Republic of Macedonia*: Cyber attack 23 SEP 24 SEP 25 SEP 26 SEP Montenegro: Earthquake Romania : Terrorist/Cyber attacks UNCLASSIFIED *Turkey recognizes the Republic of Macedonia with its constitutional name. 62 62

SEESIM 14 MEL/MIL Development Workshop Co-Chairs CPT Višnja Prebeg LTC Hristo Atanasov SEESIM 14 Scenario Managers UNCLASSIFIED 63 63

Sequence of Exercise Elements SEESIM 14 • Events: In this exercise the event is the exercise Nation/Sub-Region • Incidents: Incidents occur as a result of the event. Incidents are designed to provide the training audience with important elements of an exercise. Examples: • • Earthquake Flooding Terrorist Attack Cyber Attack • Injects: Injects are comprised of the information that is sent to the training audience. • First responders assessments • Collapsed buildings • Emergency services request UNCLASSIFIED 64 64

What we need from MEL/MIL Scripters SEESIM 14 • All inject writers should review the scenario and supporting documents • Writers should write injects that support their SEESIM 14 incidents • Injects should follow a logical geographic and chronological time line • Injects should reflect the experience and knowledge of the writers • Injects should have a time, date, location, narrative, and a training audience expected action or Incident Intended Outcome (II 0) • At the end of the conference, we need to have a rough draft of the exercise UNCLASSIFIED 65 65

Preparing for Scripting Injects SEESIM 14 • Try not to introduce new incidents – New incidents desired will be coordinated with Scenario Managers • Each cell will write injects related to their national (sub-regional) incident • Example for terrorist attack on chemical factory: – Terrorist attack with chemical threat (incident) • Indications and warnings (inject) • Terrorists spotted taking pictures of targeted object (inject) • Explosion of object(inject) • New media reports of explosion (inject) • Leaking tanks reported by observers (inject) • Assessment team on site confirms two tanks leaking (inject) • Plume envelopes the city (inject) • Type of gas is chlorine (inject) • Zone of contamination = Direction, wind, persistence (inject) • Potentially massive number of casualties (inject) • Report of 100 persons overcome in one building-at near factory (inject) UNCLASSIFIED 66 66

Conclusion of MEL/MIL Workshop SEESIM 14 • At the end of this conference, we should to have a rough draft of the exercise… • At the FCC each nation to be prepared to brief their incidents and selected injects for each incident to the conference. UNCLASSIFIED 67 67

SEESIM 14 Questions ? UNCLASSIFIED 68 68

FCC Operational WG Objectives SEESIM 14 • • Finalize Exercise design Review Exercise planning and execution timeline Finalize Exercise Manning Document Finalize Exercise Floor Plans Finalize Exercise Control Plan Finalize Exercise Control Training Plan Review and Update the POA&M UNCLASSIFIED 69

FCC Operational WG Objectives SEESIM 14 • Review and Finalize Scenario Timelines and MEL/MIL • Discuss and Finalize Mini-Exercise (MINIEX) Plan • Finalize Information Management Plan • Draft Operational Working Group Minutes UNCLASSIFIED 70

Operational Working Group Personnel SEESIM 14 Position Name Email Address Albania Bosnia and Herzegovina Bulgaria UNCLASSIFIED 71

Operational Working Group Personnel SEESIM 14 Position Name Email Address Croatia Georgia Montenegro Romania SEEBRIG UNCLASSIFIED 72

Operational Working Group Emails SEESIM 14 Position Name the former Yugoslav Republic of Macedonia* Email Address United States • * Turkey recognizes the Republic of Macedonia with its constitutional name UNCLASSIFIED 73

Operational Working Group Emails SEESIM 14 Position United States (EUCOM) Name Email Address UNCLASSIFIED 74

SEESIM 14 Questions ? UNCLASSIFIED 75