Response to and Management of Anthrax Incidents of the Department of Defense

Between March 14 and 18, 2005, possible anthrax incidents occurred at three Department of Defense (DoD) postal facilities in Northern Virginia and Washington, D.C.: the Pentagon's Remote Delivery Facility (RDF), the TRICARE Management Activity (TMA) complex at Skyline Towers, and the Defense Intelligence Agency (DIA).

The Department of Defense responded to the events in collaboration with several local and federal agencies. Although subsequent testing and analysis determined that anthrax was not present, these incidents provided an invaluable learning opportunity by presenting very different scenarios for the incidents and eliciting three very different responses.

The DoD asked the RAND Corporation to review the response and management of the incidents and make recommendations for future improvements. Based on national standards and guidelines, RAND investigators analyzed existing plans and documented actions for each incident, and made findings and recommendations at both the general and site- and system-specific levels.

The RAND team identified areas where plans and actions were consistent and responses appropriate, but also areas where plans and actions did not conform to national standards and guidelines. In the latter case, the investigators' criticisms largely reflect DOD's failure to fully adopt the National Response Plan (NRP) and the National Incident Management System (NIMS) for incident command, control, coordination, and tracking. Although the DoD had made significant efforts to prepare for terrorism, it had not defined some of the roles and responsibilities required by the NRP and NIMS in the event of an incident, and senior decision makers had not been trained on their roles in the system. This forced MoD leaders and senior managers to respond with ad hoc decisions and actions.

As a result, RAND recommends that the MoD should:

• Properly align preparedness and response models with the outbreak model: prepare for the uncertainty of the event, conduct an appropriate environmental review, and address pre- and post-event issues.
• Consider and plan for risks and values at individual facilities: develop and apply appropriate methods to assess risks and values, and plan for business continuity at critical or vulnerable locations.
• Conduct system-wide exercises to ensure proper implementation of plans.
• Use of the NRP and NIMS frameworks: in particular, clarify the roles of senior defense officials to avoid confusion and/or disruption and improve coordination and information sharing with relevant jurisdictions.

While it can be argued that MoD officials made good decisions under the circumstances, there is no doubt that a well-designed plan, in line with the NRP and NIMS plans, would have yielded much better results.