Nine Days Without CAD

This question is designed to surface whether your fallback procedures are practiced or theoretical. The first 10 minutes of a CAD-down event are the most disorienting because every habitual workflow breaks simultaneously. Callers keep calling. Units keep moving. The radio keeps going. But the screen that organizes all of it is dark.

Walk your team through it literally: who picks up the call? How does that person record the address, the call type, the caller name? Where does that information go next? Who determines the appropriate response? How do they know which units are available if unit status is not displaying? How does dispatch information get to field units whose MDTs are also dark? How do you track what has been dispatched and what has not?

The answers reveal your gaps. Centers that have practiced this can describe a specific, workable process. Centers that have not practiced this tend to describe a process that works for one or two calls before it breaks down under volume. The Bucks County team did this for nine days. That does not happen without prior training on the fallback.

This is a mass notification problem disguised as a technology problem. When CAD goes down, you need to reach every chief, every shift supervisor, and every unit in the field to tell them what is still working, what is not, and what the alternate procedures are. At 3 AM. With your CAD-integrated alerting system also offline.

Bucks County had to notify law enforcement, fire, and EMS chiefs across 130+ agencies that NCIC and CLEAN access were lost — meaning officers in the field running a license plate had to assume no information was coming back. That is a significant officer safety issue that required immediate communication through alternative channels.

Questions for your team: What is your current contact tree for mass notification to partner agency leadership? Is it in CAD, which would also be offline? Is it in a physical binder? Does your shift supervisor have phone numbers for key contacts in a format that does not depend on the system that just went down? How do you confirm receipt?

There is a real tension here. Legal counsel is right that public statements during an active cybersecurity investigation can compromise the investigation, reveal attack vectors to other threat actors, or create liability. At the same time, partner fire and EMS agencies operating without MDTs and without NCIC access need to know why, for how long, and what the alternate procedures are. Those two needs are not the same communication.

The answer most well-prepared centers settle on: separate the operational notification (what is down, what the fallback is, who to call with questions) from the public information (what is being said to media and the public). Operational notifications go to partner agency leadership immediately and continuously. Public information goes through the PIO with legal review. These run in parallel, not sequentially.

Who in your center has the authority to authorize operational notifications to partner agencies during a cybersecurity incident? Is that authority clearly documented, and does it survive a situation where your agency director is unreachable at 2 AM?

The decision not to pay the ransom was correct and ultimately successful. But it required nine days of manual operation. For some centers, nine days of manual dispatch at full call volume would be manageable. For others, it would be operationally catastrophic. The difference is almost entirely determined by two things: the quality of the backup infrastructure and the depth of the manual fallback training.

Ask your IT department: when was the CAD last backed up? Where are those backups stored, and are they isolated from the primary network (so ransomware that encrypts your CAD cannot also encrypt your backup)? How long would restoration take? Has that restoration ever been tested? What is the county or agency attorney’s guidance on ransom payment — is there a pre-established position, or will that decision be made in crisis by people who have never thought about it before?

The Pennsylvania National Guard deployed to help Bucks County. Does your state have an equivalent capability, and do you know how to request it?

This is the hardest question in the exercise. Manual dispatch works. PSAPs did it for decades before CAD existed. But it works differently at different call volumes, under different staffing conditions, and with different levels of staff experience in manual procedures. The experienced dispatcher who worked before CAD existed handles a manual shift differently than the three-year dispatcher who has never dispatched without a computer.

The assessment changes when cumulative fatigue among dispatchers begins to affect judgment. It changes when a mass casualty incident arrives and the manual tracking system cannot scale. It changes when a dispatcher who is the only one on shift who knows the manual procedures calls in sick on day six. It changes when a partner agency makes a decision based on absent NCIC information that results in a bad outcome.

Bucks County got to day nine without a reportable failure. That is a credit to their training and their people. But the margin matters. How thick is your margin?

Both entry points are human and procedural failures, not technical ones. The best firewall in the world does not protect against a technician who leaves it open. The strongest encryption does not stop an attacker who has valid credentials. The pattern across PSAP attacks is consistent: the technology is breached through a gap in the human system around it. Former employee accounts not deprovisioned. Vendor access not monitored. Phishing emails clicked by staff who have not been trained to recognize them. Software patches deferred because the center cannot afford downtime for maintenance.

For your center specifically: what happens to system access when an employee leaves? Does your IT have a documented offboarding procedure that includes credential revocation? When was the last time someone audited who has remote access to your CAD system and whether all of those access grants are still appropriate? Does your CAD vendor have remote access, and when was that access last reviewed?

These are not glamorous questions. They are the questions that determine whether your center becomes the next entry in the historical table at the top of this exercise.

Manual dispatch procedures exist at virtually every center on paper. The question is whether they have been practiced to the point where staff can execute them under stress, at volume, without coaching. Tabletop exercises where staff describe the procedure are not the same as actually running calls manually for two hours. If your most recent new hire has never dispatched without CAD, that is a training gap. If you have a CAD outage tomorrow, they will figure it out — but they will figure it out slower, and the margin for error during that learning curve is real.

Recommended action: schedule a two-hour manual dispatch drill at low-volume period. Have dispatchers run calls with CAD screens turned off, using only phone, radio, and paper. Debrief on friction points. Those friction points are your training priorities.

A CAD-down protocol that lives inside your CAD system, on a CAD-connected computer, or on a shared drive that is part of the same network being encrypted is not accessible when you need it. The protocol needs to be physically present in the center — printed, laminated, in a binder on the wall — and it needs to include phone numbers for partner agency leadership that do not depend on a system that is currently offline.

The protocol should cover at minimum: manual call documentation procedures; radio dispatch procedures for units without MDTs; contact list for partner agency leadership; mass notification procedure; IT contact hierarchy; and the decision tree for whether to request mutual aid dispatch support from a neighboring center.