Northern Exposure 17 Hot Wash 17 June 2017 Unclassified

Agenda Welcome / Opening Remarks / Introductions Administrative Comments Opening Comments Exercise Background Exercise Scenario State Mission MIARNG Mission and Intent & Vignettes Exercise Objective Discussion Way Forward Closing Comments

Administrative Announcements State Wide Exercise 17 Administrative Announcements AAR Package For additional copies of the AAR, Video Content or other exercise related documents please contact NE Coordinator APAN: Northern Exposure Collaboration Site Follow Up POC: Mr. Mike Bridges 616-309-9780 Michael.g.bridges.ctr@mail.mil

LTC Ravi Wagh G5, MIARNG Exercise Director State Wide Exercise 17 Opening Comments LTC Ravi Wagh G5, MIARNG Exercise Director

Sometimes Civil Support feels like…. State Wide Exercise 17 Sometimes Civil Support feels like….

Ground Rules Purpose: To take a hard look at ourselves and apply the lessons learned from NORTHERN EXPOSURE to sustain and improve the Michigan National Guard Team. Focus on Operations not Exercise “isms” Professional Dialogue You lead the Discussion Identify Root Causes Have a Recommendation - A way ahead

2017 Statewide Exercise Mission Statement 2017 Statewide Exercise, is a virtual and constructive Full Scale/Command Post Exercise from 14-17 June 2017 to validate local and state agency plans, in addition to confirm the readiness of the Michigan National Guard to provide Defense Support of Civil Authorities. Unclassified

State Proposed Exercise Goals and Objectives State Wide Exercise 17 State Proposed Exercise Goals and Objectives Educate exercise participants with a broad understanding of potential impacts of a long term power outage. Provide exercise participants with a frame of reference, per agencies plan, for actions required to address impacts of a long term power outage to networks and critical infrastructure. Evaluate impacts to state of Michigan lifelines and develop strategies to mitigate associated consequences. Prioritize the urgency of issues facing the state of Michigan against those of states directly impacted and determine appropriate courses of action. Develop and disseminate a uniform message to the public and media through the Joint Information Center utilizing all available mediums. Unclassified

MING CDRs Exercise Intent State Wide Exercise 17 MING CDRs Exercise Intent Purpose: Train and confirm the readiness of Michigan National Guard to provide support to civil authorities in a realistic constructive and simulated training environment. Key Tasks: Confirm the readiness of MING units to provide capability and support for State civil support missions. Increase MING interagency understanding and cooperation through incorporation of Military and Civilian Federal, State and Local partners. Exercise MING Joint Staff in employment of State (SAD/Title 32) forces during a complex catastrophe. End State: MING is trained and confirmed ready to support civil authorities within deployment timelines. Unclassified

MING Exercise Objectives State Wide Exercise 17 MING Exercise Objectives  Confirm MING readiness to conduct mission command of forces in a multi- phased, DSCA operation.  Stand-up of JFHQ-MI and JTF. Transition operational lead from JFHQ-MI to JTF.  Exercise full integration of JFHQ-MI and JTF in SEOC over three days of continuous 24 hour operations.  Coordinate and facilitate integration of Federal, State, and Local capabilities with MING throughout the duration of the exercise. Exercise the incorporation of MING units into the National Response Framework and National Incident Management System. Coordinate with and support a Unified Command at State level.  Maintain and report status of deploying assets, to include a Common Operating Picture (COP) as part of the ability to effectively command and control forces as they arrive and operate in the established Operations Area.  Integrate MING Cyber Assets into Commercial, State and Federal response to a targeted denial of services. Unclassified

State Wide Exercise 17 Primary References

State Wide Exercise 17 Scenario Purpose The purpose of this scenario is to provide participating agencies with an opportunity to assess their preparedness, response and recovery protocols, plans, and capabilities in the event of a long-term power outage precipitated by a cyber attack on the US Electric Grid. Scope The power outage incident depicted is a catastrophic cyber-attack on the U.S. power grid conducted by unidentified hostile actors inserting malware into electricity control room systems months in advance to exploit industrial control system vulnerabilities. The resulting blackout impacts The attack is released in the Midwest United States, focusing efforts across two mutually supporting electric reliability regions (Midcontinent Independent System Operator, Inc. [MISO] and PJM Interconnection [PJM]).leaving 6 states in FEMA Region V and more than 40 million residents without power and creating cascading effects affecting communications, public health, transportation and commerce across a wide region.

FEMA Region V Outage Areas State Wide Exercise 17 FEMA Region V Outage Areas Projected as of 20DEC16

Scenario Challenges Power infrastructure attack State Wide Exercise 17 Affected Regional Population ~40 million Power infrastructure attack Widespread Power Outages Industrial Accidents Secondary TIC/TIM Releases Disruption of Water/Sewer Services Degradation of Health Services Disruption to Transportation Services Disruption to Commerce Civil Unrest Scarcity of Commodities Unclassified 12

Functional Area Emphasis for NE17 State Wide Exercise 17 Functional Area Emphasis for NE17 Mission Command & Emergency Management Cyber Power Medical & Human Services Mobility Security Mission Command Cyber Medical Security Power CBRN Mobility Functional Area/ ESF determines requirements & down trace participation. Unclassified

Possible Interagency Cooperation State Wide Exercise 17 Possible Interagency Cooperation Unclassified

Exercise Design Mission Command Emergency Management SWE/NE17 Cyber 14-17JUN17 Cyber TTX&VEX 14-15JUN17 CBRN STX 15JUN17 Power TTX 14-16JUN17 Functional Area

O/C/T, EX SPT and Role Players Depart Exercise Timeline 11 June 12 June 13 June 14 June 15 June 16 June 17 June 18 June SUN MON TUE WED THU FRI SAT -2 -1 1 2 3 4 5 INCIDENT INCIDENT MSP: Warm Start TOA:JTF MSP/ SEOC Multiple Events JFHQ-MI (CPX) AAR EXCON / LOCON Sync Site Prep EXCON Arrival EXCON COMMEX Merit Cyber Range Cy VEX /Cy TTX Power Outage Cold Start POWER TTX 7 County/Municiple EOC EXCON Depart Scenario Development & Assesment CBRN STX O/C/T, EX SPT and Role Players Depart Emergent TOA:DJS DEQ St. Clair MING FTUS JS-MI JTF-MI Unclassified AS OF: 01MAY17

Major Event Time Line DJS-JTF TOA G6 -TAG VTC J1- RCM 51CST STX Cy TTX- VEX SEOC LNO DJS TOA Veteran's Home RFA Assembly Alert UNCLASSIFIED

Hot Wash Format Format will be event Driven through the Timeline and vignette driven. Leaders will discuss the following Event: Who: Discussion What was Planned? What Actually Happened ? Process; Was is acceptable, adaptable or modified? Way Forward: Proposed Solution and Timeline

Exercise Vignettes #1 Alert Process: G6 #2 Cold Start –COP: CUOPS #3 RFA/FRI Process: J3/J5 #4 Operational Communication & Systems: J3/J6 #5 Reporting: J4/J1 #5 Cyber VEX/TTX: MING Cyber #6 CST STX: 51CST #7 JTF TOA: JCoS

Alert Process Event: Rave Notification Who: COS/G6 Discussion What was Planned? What Actually Happened ? Process; Was is acceptable, adaptable or modified? Way Forward: Proposed Solution and Timeline

COP Event: Cold Start & Jump TOC Who: CUOPS Discussion What was Planned? What Actually Happened ? Process; Was is acceptable, adaptable or modified? Way Forward: Proposed Solution and Timeline

Plans and Orders Production Event: Plans and orders writing and production Who: J3/J5 Discussion What was the plan? What Actually Happened ? Were orders written and published? Were templates developed? Way Forward: Areas to Improve, Proposed Solutions and Timeline

Communications & Systems Event: Internal & External Communications Who: J3/J5 Discussion What was Planned? What Actually Happened ? Process; Was is acceptable, adaptable or modified? Way Forward: Areas to Improve, Proposed Solutions and Timeline

RFA Process Event: DMVA Support RFA Who: J3 Discussion What was Planned? What Actually Happened ? Process; Was is acceptable, adaptable or modified? Way Forward: Areas to Improve, Proposed Solutions and Timeline

Reporting Process Event: Battle Rhythm Reports Who: J4 Event: Red Cross Message Inject Who: J1 Discussion What was Planned? What Actually Happened ? Process; Was is acceptable, adaptable or modified? Way Forward: Proposed Solution and Timeline

CYBER TTX Event: Cyber VEX-TTX Who: MI Cyber Discussion What was Planned? What Actually Happened ? Process; Was is acceptable, adaptable or modified? Way Forward: Proposed Solution and Timeline

CBRN STX Event: Emergent Chemical Emergency Who: 51CST Discussion What was Planned? What Actually Happened ? Process; Was is acceptable, adaptable or modified? Way Forward: Proposed Solution and Timeline

TOA Process Event: Joint Staff JTF TOA Who: CoS, Joint Staff Discussion What was Planned? What Actually Happened ? Process; Was is acceptable, adaptable or modified? Way Forward: Proposed Solution and Timeline

EXCON Event: Force Flow Who: NE17 CTR Discussion What was Planned? What Actually Happened ? Process; Was is acceptable, adaptable or modified? Way Forward: Proposed Solution and Timeline

Did we accomplish this objective? Exercise Objective #1 Confirm MING readiness to conduct mission command of forces in a multi-phased, DSCA operation. Stand-up of JFHQ-MI and JTF. Transition operational lead from JFHQ-MI to JTF. Exercise full integration of JFHQ-MI and JTF in SEOC over three days of continuous 24 hour operations. Did we accomplish this objective?

Did we accomplish this objective? Exercise Objective #2 Coordinate and facilitate integration of Federal, State, and Local capabilities with MING throughout the duration of the exercise. Exercise the incorporation of MING units into the National Response Framework and National Incident Management System. Coordinate with and support a Unified Command at State level. Did we accomplish this objective?

Did we accomplish this objective? Exercise Objective #3 Maintain and report status of deploying assets, to include a Common Operating Picture (COP) as part of the ability to effectively command and control forces as they arrive and operate in the established Operations Area. Exercise Objective #4 Integrate MING Cyber Assets into Commercial, State and Federal response to a targeted denial of services. Did we accomplish this objective?

Questions and Alibis

Way Forward Formal AAR DTG TBD. Invites by MSP Online Survey to be published. Please Participate. Observations and suggestions may be submitted to: Mike Bridges, CTR michael.g.bridges.ctr@mail.mil

Sr. Leader Final Comments