information, such as the amount of funds allocated, obligated, and expended 

on behalf of the states is available in NEMIS.  While NEMIS' predecessor 

system did not provide adequate access or internal management controls, it 

enabled state users to access the FEMA system directly from their desktops.  

Some states even created automated ways to transfer FEMA information to 

their state systems.  However, this is no longer possible with NEMIS due to 

security requirements that limit state employees' ability to access NEMIS 

from their desktops. 

Currently, state users can access NEMIS, but not directly from their desktops.    

Instead, states rely upon stand alone computers and use manual or convoluted 

processes to transfer NEMIS information to their state systems.  For example, 

one state uses five stand alone computers to access NEMIS via a virtual 

private network, which provides a secure, encrypted connection through the 

public internet.  Users in this state manually re key NEMIS information into 

their state systems.  Alternatively, they bypass the virtual private network by 

emailing NEMIS information from the stand alones to their desktops and then 

copy the information into the state systems.  One user even sent NEMIS 

information to a home email address.  Both such practices create information 

security concerns. 

IT Systems Could More Effectively Support Operations 

Because of the unintegrated IT environment, during the 2004 hurricanes, 

EP&R systems did not effectively handle increased workloads, were not 

adaptable to change, and lacked needed capabilities.  Accordingly, FEMA 

field personnel developed manual workarounds, adjusted processes, and 

created alternative IT methods to supplement existing response and recovery 

systems and operations.  Consequently, this created operational inefficiencies 

and hindered the delivery of essential disaster response and recovery services. 

Systems Experienced Difficulty Handling Increased Workloads 

FEMA systems were unable to handle effectively the significantly increased 

workloads required to support disaster victim application processing during 

the 2004 hurricanes.  According to FEMA personnel, they lacked email server 

space to accommodate messages and reports sent from state and local 

emergency centers.  If someone did not routinely clear the emails from the 

server, its capacity would fill up sometimes as much as five to ten times per 

day and the system could crash.  At one point, the system was down for two 

hours at the height of the Florida disasters.  Workers could not save or 

download documents.  Rather than expand server capacity to resolve the 

Emergency Preparedness and Response Could Better Integrate Information Technology  

with Incident Response and Recovery 

Page 23