Call_0005-_SOO_H-_Integration_of_Public_Data_Feeds.pdf

Integration of Public Data Feeds Statement of Objectives BAA 13-012/Call 0005/ SOO H

April 24, 2017 Science and Technology Directorate Department of Homeland Security

DISTRIBUTION NOTICE: Further dissemination only as directed by DHS Office of Policy DESTRUCTION NOTICE: Destroy by any method that will prevent disclosure of contents or reconstruction of the document.

Integration of Public Data Feeds Statement of Objectives February 13, 2017

Table of Contents

1.0 Problem Statement

2.0 Purpose and Scope

3.0 Background Environment

3.1 Mission Scenarios

3.2 Current Technology Shortfalls and Threats

4.0 Potential Solution Attributes

4.1 Concept of Operations (ConOps)

4.2 Additional Capabilities

5.0 Solution Capabilities and Requirements

5.1 Must Have Requirements

5.2 Desirable Capabilities or Characteristics

6.0 System Support

6.1 Period and Place of Performance

6.2 Contract Deliverables

6.3 Transition Requirements

6.4 Regulatory/Legal Requirements

6.5 System Affordability

6.6 Training

6.7 Other Considerations

6.8 Storage and Maintenance

1.0 Problem Statement

The Project Responder (PR) 4 situational awareness capability identifies the need to, “obtain and distill specific knowledge concerning emerging threats, hazards, and conditions in a timely fashion to support incident management decisions across all phases of catastrophic incident response.”1 However, there is currently no method for first responders to proactively use open, publically-shared information to feed into a typical common operating picture (COP) for added situational awareness during incident response. Subject matter experts at the 2016 First Responder Resource Group (FRRG) Meeting further clarified and described this need for a solution that integrates all types of open-source information to inform emergency response to include but not limited to, information available from "the Internet, databases, press, radio, television, video, geospatial data, weather and traffic data feeds, photos, and commercial imagery”.

2.0 Purpose and Scope

The purpose of this solution is to allow for the use of both authoritative and informational application feeds (as listed above) and select publically-shared social media in a variety of typical, standards-based COPs already in use (e.g., Next Generation Incident Command System (NICS), global information systems (GIS), Google Earth, etc.), Further, it should include the ability to provide automated alerts based on specified, tailorable triggers and thresholds to inform incident commanders and emergency responders of potential or emerging threats for increased situational awareness.

First Responder subject matter experts (SMEs) will provide trigger requirements as a part of the development process. These triggers will include things such as a large number of tweets using particular hashtags, a sudden increase in photos with the same geotag information or a large number of social media “check-ins” at a particular location. These triggers will then be selected by the end users based on their environment and needs, data will be presented to the system in a way that will provide basic decision support to inform resource allocation and notification to relevant stakeholders. This tool would augment or be an interface module to work with existing COPs already in use by first responders and is not intended to be an additional device first responders would have to carry. The solution would most likely be accessed through a variety of common communication devices such as smartphones, tablets, laptops, and mobile data computer/tablets (MDC/Ts). Additionally, some feeds such as life-safety alerts/warnings may integrate with existing equipment or wearables and be audible or sensory (vibration, flashing lights etc.). Finally, because situational awareness is closely tied to tool and resource management, this system must be designed as an independent solution, but should also be able to interface with separate task and resource management tool solutions All data layers must be integrated onto the selected COP, thereby providing the incident commander (IC) with one device for managing multiple activities in an evolving situation.

3.0 Background Environment

Situational awareness is a critical capability for first responders to successfully plan for, respond to, and assist in recovery from an incident. Responders combine information from multiple sources to

1 Department of Homeland Security, Security and Technology Directorate, “Project Responder 4: 2014 National Technology Plan for Emergency Response to Catastrophic Incidents”, Page 15.

obtain situational awareness. Data that increases situational awareness provides real-time information on emerging, further developing, or cascading events and threats. Much of this information may be already being gathered by responding agencies through various Incident Management Systems that connect all elements of an agency’s response profile (telecommunications, wireless, network, voice, video, and audio). Ideally, this information would be integrated and displayed in a single, location-based, visual display or COP to allow incident commanders and emergency responders to visualize incident-pertinent data and information in one place. By combining and visualizing various information types, the responder will have a clearer picture of the incident and impact of cascading events, thus improving decision support through both visual data and actionable intelligence. Incident management software programs are currently used by some agencies to integrate some data using computer-aided dispatch data, resource lists, and maps. However, this information is often protected (i.e., proprietary to the jurisdiction using the program) or static (i.e., does not change based on incident characteristics) and/or otherwise inaccessible. Currently, responders may not be able to integrate publicly-available data into existing systems, since that data is not filtered or organized, nor do they receive any verification to help determine what level of impact that data should have.2

3.1 Mission Scenarios

First responders are currently engaging in large-scale, rapidly evolving incidents such as protests, active-shooter events, terrorist acts, natural disasters, utility outages, etc. Individuals directly involved in the incident (participants, bystanders, or victims) often have an “eye-witness” perspective of events and frequently share them on social media. Currently, social media posts are not readily available to first responders in a way that is useful for first responders. If first responders had the ability to ingest, filter, and utilize/manipulate that data, their decision-making and actions would be enhanced by leveraging this additional situational awareness information that is drawn from the epicenter of the incident. Accessibility to other open-source information (e.g., video, temperature, weather, traffic or population concentration, noise level, etc.) provided by on-scene fixed or ad hoc sensors, may provide additional first-hand on-scene views into the unfolding events.

Additional uses of the proposed solution would be triggers and/or warnings that alert the responder communities when a call on social media goes out for people to gather at a particular location for an event such as a surprise visit by a celebrity, flash mob, or to engage in a protest. An alert from a first responder social media intelligence aggregator/processor will allow for pre-staging of resources and early assignment of crowd control personnel to that location. Through the integration of currently available data information sharing applications such as Waze, the system could also alert first responders to traffic bottlenecks, allowing them to re-route their response and/or re-deploy traffic management resources.

3.2 Current Technology Shortfalls and Threats

First responders are unable to harness the data contained within social media and other publically available open source intelligence and information feeds to trigger automated alerts to inform incident commanders and responders about the changing incident landscape and potential or emerging threats.3 While the public information office of many departments may have Twitter and

2 Technology Foraging: Integration of Public Data Market Survey, Washington: Department of Homeland Security, 18 October 2016.

3 Ibid some other social media accounts, this is primarily used to push information out to the public.

Public information officers largely lack the resources to monitor these accounts for intelligence value. More importantly, these are disparate social media accounts and there are limited comprehensive means to aggregate, filter and visualize the information into a useful dataset for first responder usage. For example, in regards to severe weather, first responders need to have weather data aggregated to include social media posts about the conditions and NOAA weather alerts and predictions.

4.0 Potential Solution Attributes

4.1 Concept of Operations (ConOps)

The solution would be an intuitive interface that provides user defined access to a suite of standards-based publically available libraries and web service endpoints, accessible on a smartphone, tablet, laptop, desktop etc. that is capable of being visualized on a variety of typical COPs. The capability should include the ability to easily include additional server endpoints, determine icons and other display requirements, allow for user-defined temporal and spatial filtering, and provide system-generated notices and alerts. At the beginning of a shift, the first responder would view the current status of the information feeds being monitored by logging into an existing incident management system, such as the Next Generation Incident Command System (NICS), ESRI systems, Google Earth, etc.; establishing a “steady-state” based on current situational status. There would be a set of user-defined triggers that once met, would result in pre-determined alerts and warning notices to first responders. The triggers and alerts would be tailorable and scalable, based on first responder discipline, jurisdiction, and role. The user could also prompt the system for alerts for a defined location, event, person, political hotbed topic, or medical complaint.

Note the triggers in the solution will be used as notifications or suggestions but not commands.

Thus the IC could override the user-defined triggers as responders sign on to an event or shift.

As a situation unfolds, information feeds (e.g., from social media, media, citizens calling 3-1-1, weather, and traffic) would provide continued situational awareness by delivering pre-set alerts, summary data reports (i.e., numbers, location and types of social media and other resources tied to keyword searches) as well as analysis of the openly shared products (pictures, messages, etc.). The solution would also be capable of taking in first responder reports and observations of unfolding incidents they witness to improve overall awareness. First responders would receive alerts that may indicate an impending incident/event and begin to reallocate resources accordingly. If, and when, that incident materializes, they would maintain increased situational awareness, based on the additional intelligence provided by alerts generated by collective open source information and selected social media feeds into the tool. This would also provide incident commanders and other decision makers the opportunity to reallocate resources as an incident unfolds. The solution could be used as a pre-planned resource for large-scale venues (concerts, rallies, sporting events) for which an incident command post has been created. Social media feeds from inside the venue could be mined in real time and give immediate notice when there is an incident or building potential.

4.2 Additional Capabilities

Ideally, the proposed solution will integrate publically available open source data feeds and social media into intuitive streams of information and intelligence to support the response. In addition, the ideal solution would include the ability for incident commanders to further parse the information by creating ad hoc groups, for first responders to confirm and/or validate an alert to incident command, and provide predictive analytics to support decision-making. In the event, the first responder loses connection with 911 call center, the digital display of 800 MHz radio could also be used. Finally, the ideal solution would include an archival mechanism that would help assess and tailor the data to increase the usefulness and evaluate how best to achieve optimal situational awareness for a particular plan, response, or recovery.

5.0 Solution Capabilities and Requirements

5.1 Must Have Requirements (Key Performance Parameters, KPP’s) The proposed solution must:

• Seamlessly integrate with a variety of common operating pictures and communications platforms (smartphone, tablet, laptop, etc.) and their associated operating systems without negatively affecting functionality or response time;

• Provide user-defined triggers, warnings, and alerts (such as an increase in particular hashtags, social media “check-ins” at particular locations, etc) in multiple formats (visual text, voice alert, vibration, etc.) selected based on user conditions that can be changed from the application interface by the user during an event;

• Be able to display data in multiple formats (images, text, etc.) allowing user control over icons, spatial and temporal filtering etc.;

• Be open source, open standards-based (NIEM compliant) based to support platform interoperability, allowing it to augment local COPS with all-source data or otherwise easily interface with various local emergency management COPS systems to include NICS, GIS, Google Earth, and WebEOC;

• Provide an intuitive graphical user interface (GUI), which will require no additional programming;

• Provide the ability for users to toggle which social media feeds to pull data from;

• Provide the ability for users to easily include newly acquired information feeds into the system;

• Offer command-level triggered alerts that would override individually pre-set user-defined triggers

• Allow development of user profiles, including customized tags, triggers, and searches;

• Be scalable to work with technology as the common operating systems and hardware systems upgrade;

• Be capable of providing an output summary as defined by the user such as data relating to an incident, time frame or location. The format should be one that is easily assimilated in common office productivity software such as Word, Outlook, and Excel and will be more specifically defined by first responder subject matter experts during development;

• Integrate social media sharing so elements of triggered alerts can be integrated into an emergency alert and SM/MMS (short message service/multimedia message service) messages;

• Ability to perform basic data analysis to validate sources and identify trends;

• Mechanism to use orthogonal data to validate data stream (may be done using a % or scoring mechanism); and

• Software must have the capability to selectively filter data sources deemed inaccurate or questionable.

5.2 Desirable Capabilities or Characteristics

Desired characteristics include:

• The ability to create ad hoc groups, as defined by incident commanders;

• The ability for responders to confirm or validate an alert back to commanders, based on observations on the scene; and

• An archival and reporting tool to assess which social media feeds provide the greatest situational awareness.

6.0 System Support

6.1 Period and Place of Performance

The length of time of the contract shall be between 12-18 months and shall not exceed the latter.

All developmental activities will be performed at the contractor designated site(s). DHS may require the contractor to perform preliminary and critical design reviews and/or product presentations at DHS-specified locations.

6.2 Contract Deliverables

It is expected that this project would be divided into three phases, with different deliverables required in each phase as described below. Each phase would be six months in length, resulting in a project lasting up to 18 months from kickoff to completion of prototypes. The deliverables for each phase are:

• Phase I: identification of sources, development of thresholds and predictions.

• Phase II: development of the solution interface; and

• Phase III: beta-testing of the solution interface.

DHS is committed to ensuring the success of their technology by requiring the project performer to provide DHS multiple prototype deliverables which will be used for post-contract testing and evaluation. A minimum of 50 software licenses allowing for evaluation by first responders shall be provided as a final project deliverable.

6.3 Transition Requirements

DHS is also committed to ensuring the use of their technology by the first responder community by documenting metrics regarding product sales and estimated production costs for the first three years after commercialization. Additionally, to promote first responder technology awareness DHS may participate in operational exercises, demonstrations, and conferences for the first three years after commercialization.

6.4 Regulatory/Legal Requirements

DHS is committed to providing information regarding the availability of their technology to the first responder community by requiring the project performer to submit applications to be added to the DHS Federal Emergency Management Agency (FEMA) Authorized Equipment List (AEL) and the InterAgency Board for Equipment Standardization and Interoperability (IAB) Standardized Equipment List (SEL) as a final deliverable.

6.5 System Affordability

First responders’ budgets are limited and should be taken into consideration when developing and determining a price per unit cost model. A target price for the software application if licensed individually should be less than $10 to download the application. A target price for the software application if licensed by an entity should be a one-time fee of less than $25,000 plus a reasonable annual maintenance fee.

6.6 Training

Training information as required shall be provided on any specialized equipment and shall include how to properly store, clean, deploy, and maintain the basic ensemble/unit. If a replaceable part is included in the device, proper procedures for replacing that part should be specified. Any specialty requirements of personnel conducting maintenance, storage, extraction, or delivery will be identified including certification requirements. Training material shall be available initially in hard-copy, and subsequently in soft-copy format.

6.7 Other Considerations

Human Interface Requirements: The target user includes first responders across all disciplines and backgrounds and should be easy to use across platforms and technologies.

Logistics and Readiness: The solution developed under this award is envisioned as a new situational awareness tool that is incorporated into the standard tools of all first responders.

The solution should be capable of easily integrating new sources of social media.

6.8 Storage and Maintenance

The contractor shall identify all necessary storage and maintenance requirements for the proposed solution including the required maintenance schedule, if any cleaning or maintenance is needed for the solution either during use or in order to be reused subsequent times, identification of the specific components of the ensemble that requires the maintenance, the type of maintenance required, and whether the maintenance can be performed in the field by operational personnel or if it will be required to be returned to the manufacturer for the required maintenance.

If the solution is reusable, specific instructions for cleaning or otherwise preparing the solution to be reused shall be included. Any cleaning recommendations should be viable and cost effective for first responders and first responder agencies, and should ideally be able to be performed “in-house.”

In the case of software solutions, the contractor must provide estimated upgrade frequency and cost of maintenance. The cost of upgrading the software and maintenance should be no more than 15% of the purchase price.