CALL title banner
Handbook 11-07
December 2010

Appendix F

Terrorist Incidents

Some key understanding is required when discussing terrorist incidents in the homeland. According to the Strategy for Homeland Defense and Civil Support, June 2005, the Department of Defense (DOD) "does not have the assigned responsibility to stop terrorists from coming across our borders, to stop terrorists from coming through U.S. ports, or to stop terrorists from hijacking aircraft inside or outside the United States. Nor does DOD have the authority to seek out and arrest terrorists in the United States." These responsibilities belong to the Department of Justice.

Excerpt from the National Response Framework (NRF) Terrorism Incident Law Enforcement And Investigation Annex, December 2004

Coordinating Agency

Cooperating Agencies

Department of Justice/Federal Bureau of Investigation

Department of Defense
Department of Energy
Department of Health and Human Services
Department of Homeland Security
Department of State
Environmental Protection Agency

Table F-1.


The purpose of this annex is to facilitate an effective federal law enforcement and investigative response to all threats or acts of terrorism within the United States, regardless of whether they are deemed credible and/or whether they escalate to an incident of national significance. To accomplish this, the annex establishes a structure for a systematic, coordinated, unified, timely, and effective national law enforcement and investigative response to threats or acts of terrorism within the United States.


The United States regards terrorism as a potential threat to national security, as well as a violent criminal act, and applies all appropriate means to combat this danger. In doing so, the United States vigorously pursues efforts to deter and pre-empt these crimes and to apprehend and prosecute directly or assist other governments in prosecuting individuals who perpetrate or plan terrorist attacks.

To ensure the policies established in applicable presidential directives are implemented in a coordinated manner, this annex provides overall guidance to federal, state, local, and tribal agencies concerning the federal government's law enforcement and investigative response to potential or actual terrorist threats or incidents that occur in the United States, particularly those involving weapons of mass destruction (WMD) or chemical, biological, radiological, nuclear, or high-yield explosive (CBRNE) material.

Federal Agencies

The law enforcement and investigative response to a terrorist threat or incident within the United States is a highly coordinated, multiagency state, local, tribal, and federal responsibility. In support of this mission, the following federal agencies have primary responsibility for certain aspects of the overall law enforcement and investigative response:

  • DOD
  • Department of Energy (DOE)
  • Department of Health and Human Services (HHS)
  • Department of Homeland Security (DHS)
  • Department of Justice/Federal Bureau of Investigation (FBI)
  • Environmental Protection Agency (EPA)

According to Homeland Security Presidential Directive 5, "The Attorney General has lead responsibility for criminal investigations of terrorist acts or terrorist threats by individuals or groups inside the United States, or directed at U.S. citizens or institutions abroad, where such acts are within the Federal criminal jurisdiction of the United States, as well as for related intelligence collection activities within the United States, subject to the National Security Act of 1947 and other applicable law, Executive Order 12333, and Attorney General-approved procedures pursuant to that Executive order. Generally acting through the Federal Bureau of Investigation, the Attorney General, in cooperation with other Federal departments and agencies engaged in activities to protect our national security, shall also coordinate the activities of the other members of the law enforcement community to detect, prevent, preempt, and disrupt terrorist attacks against the United States. Following a terrorist threat or an actual incident that falls within the criminal jurisdiction of the United States, the full capabilities of the United States shall be dedicated, consistent with U.S. law and with activities of other Federal departments and agencies to protect our national security, to assisting the Attorney General to identify the perpetrators and bring them to justice. The Attorney General and the Secretary shall establish appropriate relationships and mechanisms for cooperation and coordination between their two departments."

Although not formally designated under this annex, other federal departments and agencies may have authorities, resources, capabilities, or expertise required to support terrorism-related law enforcement and investigation operations. Agencies may be requested to participate in federal planning and response operations and may be requested to designate liaison officers and provide other support as required.

Deployment/Employment Priorities

In addition to the priorities identified in the National Response Framework (NRF), the law enforcement and investigative response to terrorist threats or incidents is based on the following priorities:

  • Preserving life or minimizing risk to health, which are the first priorities of operations.
  • Preventing a threatened act from being carried out or an existing terrorist act from being expanded or aggravated.
  • Locating, accessing, rendering safe, controlling, containing, recovering, or disposing of a WMD that has not yet functioned, and disposing of CBRNE material in coordination with appropriate departments and agencies (e.g., DOD, DOE, EPA).
  • Apprehending and successfully prosecuting perpetrators of terrorist threats or incidents.

Planning Assumptions and Considerations

In addition to the planning assumptions and considerations identified in the NRF, the law enforcement and investigative response to terrorist threats or incidents, particularly those involving WMD and CBRNE material, are based on the following assumptions/considerations:

  • A terrorist threat or incident may occur at any time of day with little or no warning, may involve single or multiple geographic areas, and may result in mass casualties.
  • The suspected or actual involvement of terrorists adds a complicating dimension to incident management.
  • The response to a threat or actual incident involves FBI law enforcement and investigative activity as an integrated element.
  • In the case of a threat, there may be no incident site, and no external consequences, and, therefore, there may be no need for establishment of incident command system (ICS) elements such as an incident command post (ICP) or a joint field office (JFO).
  • An act of terrorism, particularly one directed against a large population center within the United States involving nuclear, radiological, biological, or chemical materials, will have major consequences that can overwhelm the capabilities of local, state, and tribal governments to respond and may seriously challenge existing federal response capabilities.
  • In the case of a biological attack, the effect may be temporally and geographically dispersed, with no determined or defined "incident site." Response operations may be conducted over a multijurisdictional, multistate region.
  • A biological attack employing a contagious agent may require quarantine by federal, state, local, and tribal health officials to contain the disease outbreak.
  • If appropriate personal protective equipment and capabilities are not available and the area is contaminated with CBRNE or other hazardous materials, it is possible that response actions into a contaminated area may be delayed until the material has dissipated to a level that is safe for emergency response personnel to operate or until appropriate personal protective equipment and capabilities arrive, whichever is sooner.


The complexity, scope, and potential consequences of a terrorist threat or incident require that there be a rapid and decisive capability to resolve the situation. The resolution to an act of terrorism demands an extraordinary level of coordination of law enforcement, criminal investigation, protective activities, emergency management functions, and technical expertise across all levels of government. The incident may affect a single location or multiple locations, each of which may be an incident scene, a hazardous scene, and/or a crime scene simultaneously.

Command and Control

The FBI is the lead agency for criminal investigations of terrorist acts or terrorist threats and intelligence collection activities within the United States. Investigative and intelligence activities are managed by the FBI from a command post or joint operations center (JOC). The command post or JOC coordinates the necessary federal law enforcement assets required to respond to and resolve the threat or incident with state, local, and tribal law enforcement agencies.

The FBI special agent in charge (SAC) of the local field office establishes a command post to manage the threat based upon a graduated and flexible response. This command post structure generally consists of three functional groups: command, operations, and operations support, and is designed to accommodate participation of other agencies, as appropriate (see Figure F-1).

When the threat or incident exceeds the capabilities and resources of the local FBI field office, the SAC can request additional assistance from regional and national assets to augment existing capabilities. In a terrorist threat or incident that may involve a WMD or CBRNE material, the traditional FBI command post will transition to a JOC.

When, in the determination of the secretary of homeland security, in coordination with the attorney general, the incident becomes an incident of national significance and a JFO is established, the JOC becomes a section of the JFO and the FBI SAC becomes the senior federal law enforcement official in the JFO coordination group. In this situation, the JOC consequence management group is incorporated into the appropriate components of the JFO.

Graphic showing flowchart of FBI command post/JOC

Figure F-1. FBI command post/JOC

The command group of the JOC provides recommendations and advice to the FBI SAC regarding the development and implementation of strategic decisions to resolve the situation. It is responsible for approving the deployment and employment of law enforcement investigative and intelligence resources. The JOC command group includes senior officials with decision-making authority from local, state, and federal agencies, as appropriate, based upon the circumstances of the threat or incident.

Specialized Teams

The domestic emergency support team is a specialized interagency team composed of subject-matter experts from the FBI, the DHS/Emergency Preparedness and Response/Federal Emergency Management Agency (FEMA), DOD, DOE, HHS, and EPA. It provides guidance to the FBI SAC concerning WMD threats and actual incidents.

Operations Group

The operations group handles all investigative, intelligence, and operational functions related to the threat, critical incident, or special event. Each unit within the operations group provides expertise in a specific functional area that is important in the overall resolution of the incident. Local, state, and federal law enforcement specialty units assigned to assist with field operations during the threat, incident, or special event coordinate their activities with the appropriate FBI field operations units through the JOC. Federal government mission-specific units are designated to help the FBI maintain respective chains of command and coordinate activities through representation in the JOC.

Operations Support Group

The operations support group units designated within the JOC are based upon the specific needs of the threat, critical incident, or special event. The personnel who staff these units are subject-matter experts in a number of specialized areas. Operations support group units can include administrative, logistics, legal, media, liaison, communications, and information management. The mission of operations support group units is to support the investigative, intelligence, and operational functions of the JOC. The administrative and logistics units have responsibilities that are similar to the finance and logistics sections in the ICS. However, they are tasked with managing only the activities related to the law enforcement investigative, intelligence, and operational functions; they do not manage the administrative and logistics functions associated with the overall incident.

DOD Support

Requests for DOD assistance for law enforcement and criminal investigation during the incident come from the attorney general to the secretary of defense through the DOD executive secretary. Once approved, the order is transmitted either directly to the unit involved or through the chairman of the Joint Chiefs of Staff. The FBI SAC informs the principal federal official (PFO), if one has been designated, when requesting this additional assistance.


Prior to an actual WMD or CBRNE incident, law enforcement, intelligence, and investigative activities generally have priority. When an incident results in the use of WMD or CBRNE material, rescue and life-safety activities generally have priority. Activities may overlap or run concurrently during the incident management, and are dependent on the threat and/or the strategies for responding to the incident.

When an incident occurs and an ICP is established on-scene, FBI personnel integrate into the ICP to enhance the ability of the FBI to carry out its mandated mission (see Figure F-2). Three specific positions within an ICP are provided. The first FBI Special Agent (SA) or joint terrorism task force member responding receives an initial briefing from the incident commander or his/her designee and works closely with the incident commander as a member of the unified command. The FBI representative then informs the local field office of the current situation and, if necessary, requests additional assets.

Graphic showing flowchart of on-scene coordination


EMS: Emergency Medical Services

Figure F-2. On-scene coordination


National Response Framework (NRF) Terrorism Incident Law Enforcement And Investigation Annex, December 2004.

Strategy for Homeland Defense and Civil Support, June 2005, DOD.



          |   Privacy and Security Notice   |     |   Accessibility Help   |   External Link Disclaimer   |   No Fear Act   |
|   U.S. Army   |   Tradoc   TRADOC   |   iSALUTE   | Ft. Leavenworth   |   Site Map   |   FOIA   |   USA.GOV   |   This is an official U.S. Army Site   |