This record is a partial extract of the original cable. The full text of the original cable is not available.

UNCLAS SECTION 01 OF 04 COLOMBO 001414 
 
SIPDIS 
 
SENSITIVE 
 
DS FOR DS/IP/SPC/WMD, DS/IP/SA, DS/SPC/EAP, AND MED 
 
E.O. 12958: N/A 
TAGS: AMED ASEC CE PTER
SUBJECT: COLOMBO EAC REPORTS LESSONS LEARNED FROM WHITE 
POWDER INCIDENT 
 
REF: A. COLOMBO 01318 
     ¶B. COLOMBO 01326 
 
¶1. (SBU) Colombo EAC convened on 08/17/04 to discuss lessons 
learned from an anthrax letter hoax that led to the closure 
of the Mission 08/10-13.  EAC members in attendance included 
the Charge', RSO, ARSO, DATT, POL, ECON, PD, ADMIN, AID, and 
RMO New Delhi. The EAC, chaired by the Charge', conducted a 
critical review of the Mission's procedures and equipment 
related to the white powder incident and identified several 
areas of improvement.  Recommendations were also made 
regarding lessons learned.  These recommendations have been 
listed below for wider dissemination as appropriate. 
 
¶2. (SBU) Summary of Incident - On the morning of Tuesday 
08/10/04, Charge' OMS removed a letter previously opened by 
the mailroom staff and addressed to the AMB, which spilled a 
white powder substance on her desk.  She immediately notified 
the RSO, who evacuated the 3rd floor CAA and reacted two 
members of the Embassy Chem/Bio team (ARSO and DATT).  GSO 
was contacted to shut down air conditioning on the 3rd floor. 
 OMS was instructed to disrobe and shower in the female 
restroom/shower located adjacent to the EXEC office space. 
OMS's clothes were double bagged and she was given a chem/bio 
training suit for her ride home.  The two-person Chem/Bio 
team collected and secured three samples of the powder 
according to DS procedures.  The letter was briefly reviewed 
to identify it as a threat letter, then double-bagged and 
held as evidence.  The OMS desk area was decontaminated 
according to DS procedures, then the Chem/Bio team 
decontaminated themselves in the same female restroom/shower 
previously used by the OMS.  Although the letter had first 
been opened in the remote mail handling facility outside the 
Chancery, the contents were not removed and the letter was 
placed in the mail distribution system.  An emergency core 
EAC discussed the situation with DS/IP/SPC/WMD and decided to 
evacuate the entire Chancery and send all employees home, 
including those in the Consular Section, the American Center 
and the International Broadcasting Bureau at Negombo.  EXEC 
suite and Mailroom were sealed with plastic sheets and duct 
tape.  RSO checked each third floor office to assure the 
individual thermostat controls were turned off.  Embassy 
Health Officer made the determination to immediately place 
the OMS, the RSO, and the Mailroom employees on Cipro due to 
their direct exposure to the unknown substance.  A 
determination regarding antibiotics for the rest of the 
Embassy community was deferred pending lab results.  It was 
then discovered the only local lab identified in the 
Mission's EAP for anthrax testing had become inactive during 
the past year.  For the local lab to become fully operational 
and complete the required testing would take four days, about 
the same time required for a sample to be expressed mailed 
and tested at CDC Atlanta.  Attempts to locate other labs in 
the region were met with negative results.  On Friday, 
08/13/04, CDC Atlanta reported the tests of the white powder 
were negative, and the Mission opened for limited operations 
that same day.  End Summary. 
 
¶3. (SBU) What We Did Right 
 
- Post's Emergency Action Team reacted calmly, 
professionally, and with great competence. 
 
- DS and MED procedures were followed to the fullest extent 
possible.  The important lesson here is that the emergency 
procedures were well documented and EAC members knew where to 
find them. 
 
- ARSO and DATT reacted quickly and with courage as the 
Chem/Bio response team.  They were familiar with the 
equipment, worked well as a team, and followed procedures 
expertly under difficult circumstances. 
 
- The Embassy Health Officer responded promptly and provided 
expert advice on health concerns, but also quickly brought 
the appropriate administrative issues into play.  He was 
familiar with the medical emergency, lab procedures, and 
relevant points of contact. 
 
- The GSO was efficient in locating and delivering 
containment/decontamination items whenever requested.  In 
emergencies, innovation is often the key to obtaining 
necessary supplies quickly, and the GSO was extremely 
effective in that regard. 
 
- Mission employees responded calmly and facilitated 
decision-making by following management instructions promptly 
and without panic.  Some officers were able to conduct work 
from home, others continued meetings off site.  One officer 
had the presence of mind to bring a bundle of letterhead home 
to continue official communications on his personal computer. 
 
 
- Post's Emergency Action Plan worked.  No plan is perfect, 
but the advance preparation and attention to detail that goes 
into an EAP makes responding to an actual emergency 
infinitely easier. 
 
- Headquarters support was excellent.  DS/IP/SPC/WMD and MED 
provided expert advice on a 24-hr basis.  Coordination 
between MED and CDC Atlanta was excellent.  Special 
recognition should go to CDC Atlanta for a prompt turnaround 
of lab results. 
 
¶4. (SBU) What We Could Have Done Better 
 
- Mail Inspection Procedures.  DS procedures for outside mail 
inspection were in place, but it appears at the time of the 
incident those procedures were not closely followed. 
Internal inquiries by RSO and IPO determined that the 
envelope in question had been cut open by the mailroom and 
examined at one end, but the letter had not been removed or 
the envelope shaken out.  Human nature being what it is, 
particularly in areas of redundant security functions such as 
mail or vehicle inspection, the lesson to be learned here is 
that it is important for supervisors to closely monitor and 
when necessary, retrain subordinates to assure proper 
security procedures are followed. 
 
- Equipment Lapses.  A post-incident review of the chem/bio 
equipment revealed that some of the react suits had obviously 
been used in training exercises and were showing signs of 
wear and tear, particularly around the foot area.  We also 
found most of our chemical test kits to be missing.  It is 
unclear if the test kits had been used up as training devices 
or never delivered.  Our inspection also revealed poor 
quality duct tape that failed to stick to the Tyvex suits, 
and a shortage of basic cleanup items such as buckets, 
sponges, bleach, brushes, towels/rags, and large plastic 
garbage cans for stowing/securing items once they are used. 
These items should be inventoried, pre-positioned, and 
dispersed throughout a facility on all floors so that at 
least some resources are accessible in the event one part of 
a building is shut down. 
 
- Training Deficiencies.  RSO notes that the first time he or 
the ARSO had seen the sample collection kits/procedures was 
on the day of the emergency, despite having several chem/bio 
courses under their collective belts.  Although DS training 
focus on decontamination is important, additional training in 
evidence collection and use of the sample collection kits 
would be useful. 
 
- Chem/Bio Team Attrition.  Colombo's incident occurred in 
the middle of summer rotation.  As a result, several of the 
Chem/Bio Team members had just recently departed post and 
replacements had yet to be identified. Fortunately, only two 
responders were needed for this particular incident.  A 
larger scale event would have exploited our shortage of 
responders. 
 
- Periodic Lab Checks.  There is only one lab in Sri Lanka 
qualified to conduct lab tests for anthrax.  Once our 
incident occurred, we found that the lab had become inactive 
during the past year.  No other labs were available in the 
region.  Posts should follow up with local labs periodically 
to assure that they remain viable resources.  One EAP 
recommendation in planning is to identify alternative labs in 
the region and obtain the necessary permits/authorizations 
for shipping samples ahead of time. 
 
- Change of Clothes.  All employees should consider having an 
alternative change of clothes at the office.  In the case of 
the OMS who opened the letter thus potentially contaminating 
her clothes, we were able to locate an old training chem/bio 
suit for her to wear home.  GSO is in the process of ordering 
inexpensive paper jumpsuits for all embassy personnel.  These 
clothing items should be dispersed throughout the facility in 
the event one section becomes contaminated or is shut down. 
 
 
- MSG React.  In retrospect, we could have reacted the 
Marines for this event.  They all have basic chem/bio 
training and would have been useful in securing the various 
floors and directing employees away from the hazardous area. 
However, consideration should be given in certain situations 
to keeping the Marines off the compound to preserve their 
health and safety for later deployment as necessary. 
 
- Air System Shut Down.  The air system in Colombo's Chancery 
is controlled in each individual office by a thermostat 
switch.  In some instances, an office suite may have several 
thermostats, one for each room.  This setup had advantages 
and disadvantages for us in that we were able to keep air 
running in vital areas such as the IPC with a reasonable 
degree of confidence that those units were separate from the 
contaminated area.  The disadvantage was that once the EXEC 
suites were sealed, we were not completely confident all 
thermostats inside the suites had been shut down.  It is 
important for response teams to have a basic knowledge of a 
facility's air systems. 
 
- Evacuation.  Colombo's incident occurred at a time when 
many employees were just beginning to arrive to their 
offices.  RSO's decision to evacuate the third floor was 
prompt, but instruction should have been given to the MSG to 
prevent additional employees from entering the building, 
particularly since our primary entrance led employees past 
the potentially contaminated mailroom.  In the process of 
evacuation, we also failed to effectively employ the floor 
warden system to check that the offices had in fact been 
cleared. 
 
- EAP Plans for Other USG Facilities.  The International 
Broadcasting Bureau (IBB) site in Negombo is a two-hour drive 
north from Colombo.  Had a white powder incident occurred at 
that location, an Embassy Chem/Bio team response with 
equipment would have been at least three hours away. 
Individual react plans with basic equipment should be in 
place for remote sites, including IBB and the American 
Center. 
 
- Evidence Collection.  While the primary function of our 
Chem/Bio Team was not to conduct a full investigation at the 
time of their response, in retrospect we realized the team 
should have taken a bit more time to review the threat letter 
before securing and sealing it.  Obviously, it is not 
possible to use a camera to photograph the evidence since the 
camera itself would become contaminated in the process, but 
we did conclude that one of the Chem/Bio Team members could 
have used the OMS telephone to describe the letter in greater 
detail and comment on the envelope markings.  This would have 
helped us evaluate when exactly the letter was received in 
the mailroom, allowing a better estimate of what other mail 
may have been contaminated. Making note of the specific 
return address would have also permitted the RSO to initiate 
an investigation sooner. 
 
- Loose Lips Sink Ships.  Within minutes of an RSO email 
announcement advising employees of the white powder incident, 
the information reached the local press with details that 
could only have come from within the Embassy.  This placed 
our employees at increased risk by increasing the potential 
for another attack by a copy-cat.  An EAC should take into 
consideration the political/security repercussions of 
information leaks surrounding a security incident and devise 
an appropriate strategy through its Public Diplomacy Office. 
 
 
¶5. (SBU) What We Are Doing Now 
 
- Mail Inspection Procedures.  The EAC approved that the 
plastic "gloves box" would be used to open all local mail 
with postage stamps, all mail with hand-written address, all 
mail with a hand-written return address, and all mail with a 
typed return address.  The only local mail not opened in the 
"gloves box" would be local mail franked by a postage meter 
and having a recognized pre-printed corporate return address. 
 This mail would be opened in the separate mail opening room, 
but not in the "gloves box."  In addition, all inspected 
letters would be removed and stapled to their respective 
envelopes. 
 
- Mail Inspection Room.  The EAC agreed that the work 
environment in the mail inspection room could be improved, so 
physical enhancements will be added to make a better 
workplace environment. 
 
- Update Chem/Bio Team.  Post has begun immediate 
identification and training of replacement Chem/Bio Response 
Team members. 
 
- Replenish Chem/Bio Supplies.  Post has conducted a 
comprehensive review of supply needs and replacement orders 
will be made.  New Tyvex suits requested in Ref A have 
already been received from the Department and are much 
appreciated.  Additional requests may be forthcoming. 
 
- Investigate the Letter.  An investigation of the threat 
letter is underway (Ref B). 
 
- Disperse Supplies.  Mission's Chem/Bio Incident supplies 
will be dispersed throughout its various facilities to avoid 
the risk of losing them in a single catastrophic event. 
Supplies to be dispersed include written 
procedures/guidelines, react gear, cleanup materials, and 
medication. 
 
- Update Contacts.  Post has begun to review and update all 
appropriate emergency points of contact. 
 
- Containment/Decontamination Supplies - RSO and GSO have 
begun to inventory, resupply, and disperse necessary 
containment and decontamination materials. 
 
- Research Work From Home Options - In an effort to 
facilitate employees working from home in times of 
emergencies, IPC will research options for transferring 
Departmental email addresses to home computers, allowing 
employees to conduct unclassified business with the 
Department from home. 
 
¶6. (U) Colombo POC for EAP issues is RSO Alex Moore 
(94-11-244-8601). 
ENTWISTLE