CISA Updates its Fire as a Weapon Information Guide

CISA recently published an updated version of its “Fire as a Weapon” information guide, providing an overview of the threat; statistics and information on recent and notable incidents; potential indicators of an imminent or in-progress attack; and protective measures and mitigation strategies. In recent years, a range of threat actors have utilized fire as a weapon to attack critical infrastructure assets.

The report notes the U.S. faces increasingly complex threats from terrorists, violent extremists, and acts of targeted violence. Historically, threat actors have used fire as a weapon to target critical infrastructure. The tactic can include attacks such as arson, improvised incendiary devices (IIDs), and deliberate forest fires, among others. Threat actors can use fire as a weapon to target public gatherings and individuals directly. Incidents of fire used as a weapon have increased recently as malicious actors likely favor it as a cheap and readily available means for an attack. According to CISA’s research, statistics show an increase of assailants using fire as a weapon to damage critical infrastructure, target public gathering places, and harm communities. IIDs were the most commonly used device type during recent mass demonstration incidents. However, arson has also increased 29.8%, from 29,694 incidents in 2021 to 38,539 in 2022.

Critical infrastructure organizations, including water and wastewater systems, have experienced fire as a weapon attacks, including incidents that led to operational disruptions. For example, in its most recent Quarterly Water Sector Incident Summary report, WaterISAC detailed an incident where juveniles built a Molotov cocktail and threw it at the perimeter fence of a utility’s water treatment plant. A few years earlier, a very large wastewater utility reported that an employee discovered a pyrotechnic device at a sewer pump station. The device was described as ten cans of spray paint taped around a pyrotechnic. The utility alerted law enforcement, which sent a bomb squad to dismantle the device. In other sectors, anarchist violent extremists (AVEs) have used fire to attack railroads and, most recently, AVEs in Germany burned down an energy pylon to disrupt operations at a Tesla factory. Last year, an attacker lit his car on fire inside a Las Vegas solar power plant, which led the facility to be unable to produce electricity.

As noted above, the guide includes potential indicators of an imminent or in-progress attack, as well as protective measures and mitigation strategies, which utilites are encouraged to review. Access the full guide below.