1. Northern Exposure 17
Hot Wash
17 June 2017
Unclassified

2. Agenda Welcome / Opening Remarks / Introductions
Administrative Comments
Opening Comments
Exercise Background
Exercise Scenario
State Mission
MIARNG Mission and Intent & Vignettes
Exercise Objective Discussion
Way Forward
Closing Comments

3. Administrative Announcements
State Wide Exercise 17
Administrative Announcements
AAR Package
For additional copies of the AAR, Video Content or other exercise related documents please contact NE Coordinator
APAN: Northern Exposure Collaboration Site
Follow Up POC:
Mr. Mike Bridges

4. LTC Ravi Wagh G5, MIARNG Exercise Director
State Wide Exercise 17
Opening Comments
LTC Ravi Wagh G5, MIARNG Exercise Director

5. Sometimes Civil Support feels like….
State Wide Exercise 17
Sometimes Civil Support feels like….

6. Ground Rules
Purpose: To take a hard look at ourselves and apply the lessons learned from NORTHERN EXPOSURE to sustain and improve the Michigan National Guard Team.
Focus on Operations not Exercise “isms”
Professional Dialogue
You lead the Discussion
Identify Root Causes
Have a Recommendation - A way ahead

7. 2017 Statewide Exercise Mission Statement
2017 Statewide Exercise, is a virtual and constructive Full Scale/Command Post Exercise from June 2017 to validate local and state agency plans, in addition to confirm the readiness of the Michigan National Guard to provide Defense Support of Civil Authorities.
Unclassified

8. State Proposed Exercise Goals and Objectives
State Wide Exercise 17
State Proposed Exercise Goals and Objectives
Educate exercise participants with a broad understanding of potential impacts of a long term power outage.
Provide exercise participants with a frame of reference, per agencies plan, for actions required to address impacts of a long term power outage to networks and critical infrastructure.
Evaluate impacts to state of Michigan lifelines and develop strategies to mitigate associated consequences.
Prioritize the urgency of issues facing the state of Michigan against those of states directly impacted and determine appropriate courses of action.
Develop and disseminate a uniform message to the public and media through the Joint Information Center utilizing all available mediums.
Unclassified

9. MING CDRs Exercise Intent
State Wide Exercise 17
MING CDRs Exercise Intent
Purpose: Train and confirm the readiness of Michigan National Guard to provide support to civil authorities in a realistic constructive and simulated training environment.
Key Tasks:
Confirm the readiness of MING units to provide capability and support for State civil support missions.
Increase MING interagency understanding and cooperation through incorporation of Military and Civilian Federal, State and Local partners.
Exercise MING Joint Staff in employment of State (SAD/Title
32) forces during a complex catastrophe.
End State: MING is trained and confirmed ready to support civil authorities within deployment timelines.
Unclassified

10. MING Exercise Objectives
State Wide Exercise 17
MING Exercise Objectives
 Confirm MING readiness to conduct mission command of forces in a multi-
phased, DSCA operation.
 Stand-up of JFHQ-MI and JTF.
Transition operational lead from JFHQ-MI to JTF.
 Exercise full integration of JFHQ-MI and JTF in SEOC over three days of continuous 24 hour operations.
 Coordinate and facilitate integration of Federal, State, and Local capabilities with MING throughout the duration of the exercise.
Exercise the incorporation of MING units into the National Response Framework and National Incident Management System.
Coordinate with and support a Unified Command at State level.
 Maintain and report status of deploying assets, to include a Common Operating Picture (COP) as part of the ability to effectively command and control forces as they arrive and operate in the established Operations Area.
 Integrate MING Cyber Assets into Commercial, State and Federal response to a targeted denial of services.
Unclassified

11. State Wide Exercise 17
Primary References

12. State Wide Exercise 17
Scenario
Purpose
The purpose of this scenario is to provide participating agencies with an opportunity to assess their preparedness, response and recovery protocols, plans, and capabilities in the event of a long-term power outage precipitated by a cyber attack on the US Electric Grid.
Scope
The power outage incident depicted is a catastrophic cyber-attack on the
U.S. power grid conducted by unidentified hostile actors inserting malware into electricity control room systems months in advance to exploit industrial control system vulnerabilities. The resulting blackout impacts The attack is released in the Midwest United States, focusing efforts across two mutually supporting electric reliability regions (Midcontinent Independent System Operator, Inc. [MISO] and PJM Interconnection [PJM]).leaving 6 states in FEMA Region V and more than 40 million residents without power and creating cascading effects affecting communications, public health, transportation and commerce across a wide region.

13. FEMA Region V Outage Areas
State Wide Exercise 17
FEMA Region V Outage Areas
Projected as of 20DEC16

14. Scenario Challenges Power infrastructure attack State Wide Exercise 17
Affected Regional Population ~40 million
Power infrastructure attack
Widespread Power Outages
Industrial Accidents
Secondary TIC/TIM Releases
Disruption of Water/Sewer Services
Degradation of Health Services
Disruption to Transportation Services
Disruption to Commerce
Civil Unrest
Scarcity of Commodities
Unclassified 12

15. Functional Area Emphasis for NE17
State Wide Exercise 17
Functional Area Emphasis for NE17
Mission Command & Emergency Management
Cyber
Power
Medical & Human Services
Mobility
Security
Mission Command
Cyber
Medical
Security
Power
CBRN
Mobility
Functional Area/ ESF determines requirements & down trace participation.
Unclassified

16. Possible Interagency Cooperation
State Wide Exercise 17
Possible Interagency Cooperation
Unclassified

17. Exercise Design Mission Command Emergency Management SWE/NE17 Cyber
14-17JUN17
Cyber
TTX&VEX
14-15JUN17
CBRN
STX
15JUN17
Power
TTX
14-16JUN17
Functional Area

18. O/C/T, EX SPT and Role Players Depart
Exercise Timeline
11 June
12 June
13 June
14 June
15 June
16 June
17 June
18 June
SUN
MON
TUE
WED
THU
FRI
SAT -2 -1 1 2 3 4 5
INCIDENT
INCIDENT
MSP:
Warm Start
TOA:JTF
MSP/ SEOC
Multiple
Events
JFHQ-MI (CPX)
AAR
EXCON / LOCON Sync
Site Prep
EXCON Arrival
EXCON COMMEX
Merit Cyber Range
Cy VEX /Cy TTX
Power Outage
Cold Start
POWER TTX
7 County/Municiple EOC
EXCON Depart
Scenario Development & Assesment
CBRN STX
O/C/T, EX SPT and Role Players Depart
Emergent
TOA:DJS
DEQ
St. Clair
MING FTUS
JS-MI
JTF-MI
Unclassified
AS OF: 01MAY17

19. Major Event Time Line DJS-JTF TOA G6 -TAG VTC J1- RCM 51CST STX
Cy TTX- VEX
SEOC LNO
DJS TOA
Veteran's Home RFA
Assembly
Alert
UNCLASSIFIED

20. Hot Wash Format
Format will be event Driven through the Timeline and vignette driven. Leaders will discuss the following
Event:
Who:
Discussion
What was Planned?
What Actually Happened ?
Process; Was is acceptable, adaptable or modified?
Way Forward: Proposed Solution and Timeline

21. Exercise Vignettes #1 Alert Process: G6 #2 Cold Start –COP: CUOPS
#3 RFA/FRI Process: J3/J5
#4 Operational Communication & Systems: J3/J6
#5 Reporting: J4/J1
#5 Cyber VEX/TTX: MING Cyber
#6 CST STX: 51CST
#7 JTF TOA: JCoS

22. Alert Process Event: Rave Notification Who: COS/G6 Discussion
What was Planned?
What Actually Happened ?
Process; Was is acceptable, adaptable or modified?
Way Forward: Proposed Solution and Timeline

23. COP Event: Cold Start & Jump TOC Who: CUOPS Discussion
What was Planned?
What Actually Happened ?
Process; Was is acceptable, adaptable or modified?
Way Forward: Proposed Solution and Timeline

24. Plans and Orders Production
Event: Plans and orders writing and production
Who: J3/J5
Discussion
What was the plan?
What Actually Happened ?
Were orders written and published? Were templates developed?
Way Forward: Areas to Improve, Proposed Solutions and Timeline

25. Communications & Systems
Event: Internal & External Communications
Who: J3/J5
Discussion
What was Planned?
What Actually Happened ?
Process; Was is acceptable, adaptable or modified?
Way Forward: Areas to Improve, Proposed Solutions and Timeline

26. RFA Process Event: DMVA Support RFA Who: J3 Discussion
What was Planned?
What Actually Happened ?
Process; Was is acceptable, adaptable or modified?
Way Forward: Areas to Improve, Proposed Solutions and Timeline

27. Reporting Process Event: Battle Rhythm Reports Who: J4
Event: Red Cross Message Inject
Who: J1
Discussion
What was Planned?
What Actually Happened ?
Process; Was is acceptable, adaptable or modified?
Way Forward: Proposed Solution and Timeline

28. CYBER TTX Event: Cyber VEX-TTX Who: MI Cyber Discussion
What was Planned?
What Actually Happened ?
Process; Was is acceptable, adaptable or modified?
Way Forward: Proposed Solution and Timeline

29. CBRN STX Event: Emergent Chemical Emergency Who: 51CST Discussion
What was Planned?
What Actually Happened ?
Process; Was is acceptable, adaptable or modified?
Way Forward: Proposed Solution and Timeline

30. TOA Process Event: Joint Staff JTF TOA Who: CoS, Joint Staff
Discussion
What was Planned?
What Actually Happened ?
Process; Was is acceptable, adaptable or modified?
Way Forward: Proposed Solution and Timeline

31. EXCON Event: Force Flow Who: NE17 CTR Discussion What was Planned?
What Actually Happened ?
Process; Was is acceptable, adaptable or modified?
Way Forward: Proposed Solution and Timeline

32. Did we accomplish this objective?
Exercise Objective #1
Confirm MING readiness to conduct mission command of forces in a multi-phased, DSCA operation.
Stand-up of JFHQ-MI and JTF.
Transition operational lead from JFHQ-MI to JTF.
Exercise full integration of JFHQ-MI and JTF in SEOC over three days of continuous 24 hour operations.
Did we accomplish this objective?

33. Did we accomplish this objective?
Exercise Objective #2
Coordinate and facilitate integration of Federal, State, and Local capabilities with MING throughout the duration of the exercise.
Exercise the incorporation of MING units into the National Response Framework and National Incident Management System.
Coordinate with and support a Unified Command at State level.
Did we accomplish this objective?

34. Did we accomplish this objective?
Exercise Objective #3
Maintain and report status of deploying assets, to include a Common Operating Picture (COP) as part of the ability to effectively command and control forces as they arrive and operate in the established Operations Area.
Exercise Objective #4
Integrate MING Cyber Assets into Commercial, State and Federal response to a targeted denial of services.
Did we accomplish this objective?

35. Questions
and
Alibis

36. Way Forward Formal AAR DTG TBD. Invites by MSP
Online Survey to be published. Please Participate.
Observations and suggestions may be submitted to:
Mike Bridges, CTR

37. Sr. Leader
Final Comments