Disaster Recovery Journal

IBM is currently assisting 30 customers that normally operate out of the World Trade Center. These customers, which choose not to be identified at this time because of lingering security concerns, are primarily engaged in the financial services, insurance and transportation industries.

The most immediate needs of customers included equipment replacement and repair, user and LAN support, processing, output and networking.

Within minutes of the news of the World Trade Center blast being carried by CNN, IBM Business Recovery Services’ (BRS) customer service representatives began contracting BRS subscribers by telephone to determine their requirements.

In addition, many other parts of IBM were, and continue to be, involved with these 30 customers. For example, IBM’s Pennant Systems built 15 IBM 4224 table top impact printers the Saturday after the blast specifically for WTC customers. These printers were up and running at the customer’s location by early Sunday afternoon.

Further, IBM U.S. Marketing & Services’ offices, in the heart of New York’s financial district, worked with the IBM Personal Computer Co. to arrange for almost 300 PS/2s to be delivered, set up and operational at another customer’s alternate site by 9:30 a.m. Monday. The branch even found office space for customers, set up telephones and work areas, including the desks. IBM also offered to share its office space with customers that couldn’t obtain alternate work sites.

The bottom line was that BRS, and the many other parts of IBM, were prepaid to react and reacted quickly to this type of event. BRS had prepared a terrorist response plan several years ago during Operation Desert Storm, to protect against the threat of a terrorist to a bomb attack. During the course of developing the plan, commitments were secured from nearly a dozen ISSC data centers to provide both the equipment and people to recover our customers, should the need arise. As a result of this planning and foresight, IBM was able to coordinate a quick and seamless response to its customers in need.

This article adapted from Vol. 6 #2.

Northern Ireland

Terrorism coverage has been excluded in Northern Ireland for a number of years. In 1977, the British Insurance Association announced a standard form of exclusion relating to terrorism losses in Northern Ireland. This led the Irish government to introduce the Criminal Damage (Compensation) Northern Ireland (Order of 1977).
In order to be able to benefit under this act, a claimant must show that the damage incurred was unlawfully, maliciously or wantonly caused to property either by a riotous assembly or as a result of an act committed maliciously by a person acting on behalf of or in connection with an unlawful association. Under the act, a justification for a claim is a certificate issued by the Chief Constable of the Royal Ulster Constabulary indicating that the loss falls under one of these headings. Insurers have not in fact excluded riot losses from their coverage but many claims under the other section of the order can effectively be considered terrorism claims.

Spain

In Spain, terrorism is one of the catastrophe perils covered by the Corsorcio system, which is both obligatory and financed by the government. Premiums are collected by statutory rates on property values. Corsorcio also covers other catastrophes, including floods, and earthquakes, but the system does not include business interruption coverage. There is no restriction on the private market providing this catastrophe perils coverage, but the contributions must still be made to the Corsorcio pool. Companies operating in Spain have no difficulty buying adequate limits of terrorism coverage for property damage and business interruption, and the market tends to provide for coverage other than Corsorcio’s on a difference-in-conditions basis.

France

In France, full terrorist coverage is available for property damage insurance, and in fact legislation requires insurers to provide this protection. Under this arrangement, the direct insurer has the option to retain the risk, reinsure it on the commercial market or reinsure the risk with the CCR, which is the French state-controlled reinsurer. This flexible arrangement allows direct insurers to vary the percentage that they reinsure on a year-by-year or case-by-case basis. This obligation to insure does not apply to business interruption, although in practice both property and business interruption can be purchased to very adequate limits in the open market. These insurers have not however, experienced losses as large as those that hit London and New York in recent years.

France also has a pool to which insurers are obligated to contribute. This pool provides protection for personal injury to anyone harmed in a terrorist attack. France also has a catastrophe reinsurance program colloquially referred to as CAT NAT. This scheme supported by the government reinsurer, applies a levy of nine percent to all property premiums which pays for catastrophe perils losses. If the problems that the United Kingdom now have were to develop in France, it is likely that an adjustment would be made to the CAT NAT system.

South Africa

In South Africa, there is obviously a very considerable threat from terrorism. In 1976, following riots in Soweto, the insurance market determined that it could not cover terrorism risks and advised the South African government that they were canceling cover. However, a cooperative deal was worked out between 15 of the largest direct insurers and the government. This involved the 15 companies effectively capitalizing a pool called the South African Strikes and Riots Insurance Association (SASRIA); the original capitalization was five million rand spread proportionately according to the size of the 15 companies, which was subsequently raised to 10 million rand.

The arrangement’s main feature, however, was the government’s backing as a reinsurer of last resort. Soon after the pool was established, the reinsurance market became involved in excess of loss protection, and SASRIA is now very significantly funded at four billion rand, or approximately $75 million. Clearly, the pool has very significant exposures, but it seems that the stated objective of the arrangement is to build up the pool to approximately 20 billion rand. Although there are limitations to this system, it seems to meet the needs of most businesses.

This article is reprinted by permission of Risk Management magazine.

At 4:31 a.m. on Monday, January 17, Bob Steinbach, Emergency Management Coordinator for the City of Los Angeles Department of Building & Safety, was asleep at his home in the suburban city of Lomita.

At 4:32 a.m. he was on the floor of his bedroom, thrown out of bed by one of the worst earthquakes ever to hit Southern California -- and for the next several weeks his job became one of the most crucial as teams of disaster experts worked to help the shaken city piece itself back together.

Will the recovery really work? The issues related to answering that question are indeed mind-boggling. Providing fast, complete backup and recovery in today’s 24X7 processing environments for both local and disaster outage scenarios across multiple applications and data types is of paramount importance. Downtime windows of 8-12 hours each weekend to create full-volume dumps are becoming unworkable. Incremental backup failures each night are becoming more common. The use of Aggregate Backup and Recovery Support (ABARS) will provide the necessary function required to address these concerns.

Many kinds of backup tools are currently used in today’s environment, each intended to address different recovery situations. Volume dumps are intended to protect against HDA failure, incremental backups protect against single data set loss, IMAGECOPIES are needed for online databases, etc.

Although most installations focus on the backup process, the real issue is RECOVERY. Recovery must be cost-effective, streamlined, complete and all-encompassing. Enormous overhead is spent backing up data redundantly with multiple tools and still many recovery requirements can’t be met. Problems traditionally include missing data, incompatible device geometries, data/catalog synchronization issues, huge manual effort and unacceptably long recovery times.

Additionally, implementing DFSMS and its related strategies requires that old, ‘tried and true’ backup processes be re-examined, especially for disaster recovery. Previously, ‘critical’ data was hand placed on certain DASD and dumped for backup purposes. DFSMS, if fully implemented and exploited correctly, completely removes physical device dependencies, with data now existing anywhere in a hierarchy. SMS Managed Tape further complicates this issue. Aggressive migration policies cause volume dumps to miss critical data. Multi-volume data sets cause additional complications. Volume dumps may get a nice return code zero (0) at backup time, but have inherent problems during the recovery.

I received the assignment the second I entered the chief photographer’s office at the Savannah Morning News and Daily Press. There was a fuel spill at a local industrial site. I was assigned to get the photos. I was to go with the reporter, and have the shots processed by deadline for the afternoon edition, two hours away.

It took about 20 minutes to get to the industrial site. With ten minutes spent picking up the reporter and getting to the car, about a half-hour of my two hours was gone. I needed 30 minutes to process and print the film. If I assumed it would take me about a half-hour to get back to the office, that left me around a half-hour to get the shots, and for the reporter to get his facts. About normal.

When we arrived at the scene, a company official refused to let us enter the premises. The reason, she explained, was that the electrical equipment in my camera could spark and cause an explosion. Beyond the gate where we were standing we saw people in fire-proof suits running around chaotically.

I held up my camera and said it was a Leica. A Leica, I explained, had no batteries. It was a completely manual camera. The light meter on top worked by photoelectric cell, and I could take that off, if that were a concern.
The official was not moved. The friction of the camera mechanism could cause a spark, which could cause an explosion, she said.

That was clearly an impossibility. But the press does not have any absolute right to access to a disaster. Traditionally, members of the press have been given access on the grounds that the public has a right to know about newsworthy events. Plus, police, fire and emergency agencies love good press.

But this company official was well within her rights to bar us from the private property of her company. She gave the reporter only the sketchiest of details. The bitter cold Savannah suffered the night before had caused a pipe to burst in a fuel storage tank. An undetermined amount of fuel had spilled. Crews were trying to stop the leak and clean up the fuel. All media were banned to avoid the possibility of fire and explosion.

The exchange had taken ten of our allotted thirty minutes. Since the official would not grant us access, we returned to the right-of-way along the highway. There we could stand, observe and photograph without intrusion.
The sight was grim. We could hear muffled orders being shouted, the occasional obscenity as something apparently didn’t go right, people scurrying frantically in fire-proof suits. The official indicated the place could blow at anytime, and I was prone to believe her.

We checked with the police, fire and paramedic crews. They had no more information than we had. They had not been asked to help in the cleanup, and they responded to the call as a precaution.

I took what photos I could, using my longest lens, shooting through the chain-link fence. I photographed the frantic scene of leaking fuel and frantic movement by people in their fire-proof suits. Time was up, we had to leave.
The reporter had just enough information to write a long cutline for the photo of the disaster. The cutline explained that a burst pipe had caused volatile fuel to leak, and emergency crews responded in the event of fire or explosion. This photo and cutline ran on page 1 of the afternoon paper.

The impression left was that the town of Savannah, or a goodly portion thereof, was about to be immolated.
As the day wore on, the emergency crews were called back to their stations. It became apparent the fuel spill was under control. By late in the afternoon, company officials were more cooperative, possibly because they saw the holocaust afternoon edition.

Yes, company representatives said, there had been a fuel spill. Yes, there had been a danger of fire, but the cold weather kept volatility to a minimum. A dike surrounding the fuel storage tank captured all the spilled fuel. Regular disaster drills had kept the company’s crews proficient in handling this kind of emergency. While the situation was serious, there was no extreme danger to the plant or the town.

The original response by a company official, however, made it appear as though things were much worse. The press was forced to rely on its own observations. It was these observations, not facts supplied by the company, which were printed.

As I work with clients, I relate this story as a way of illustrating the importance of including media relations as part of the disaster recovery plan.

All too often, this suggestion is rejected.

I didn’t know then why that company official in Savannah responded the way she did. However, since working with other companies’ disaster recovery plans, some generalities have been formed.

This is MY Disaster — Keep Out!

A company recovering from a disaster views it as a personal loss. It is no one’s business how it chooses to act to recover from the damage. Depending on the severity of the disaster, local officials may be notified — police, fire, emergency squads, and the like. But the notion that others might be affected doesn’t seem to enter the corporate consciousness.

A business is not an island. Any business affects the lives of its suppliers, customers, employees and stock holders. The economy of an entire area can rise and fall with the fortunes of one company. A disaster affects far more than the people and equipment who are a direct part of the firm. A corporate disaster is a shared disaster.

The Media Always Look for the Worst

There can develop within companies the idea that any encounters with the media are to be avoided, since the reporters are always out to perform a hatchet job. Since the opportunity to hatchet a company is particularly easy during a disaster, a time of crisis is one time the press should especially be avoided.

While there are certainly cases of unbalanced, biased reporting, it is not correct to think all reporters are simply pushing their own agendas. When information is available, reporters will usually do a good job of presenting a news story in an objective manner. If one side of a story seems to have more play than another, it is usually because there was simply more information readily available from one source than another.

In a Crisis, There is No Time for the Press

In the midst of chaos, the last thing anyone wants is someone hanging around asking “what happened and what are you doing about it now?” Yet a disaster recovery manager will be answering just these questions when asked by his superiors and fellow workers. It is easy to anticipate the questions which will be asked not only by the press, but by other company officials. Since a summary of the disaster response will have to be provided to company officials anyway, it takes a small effort to produce another copy for the press.

We Have a Public Relations Department To Do This

Handling the press during a crisis seems like the task of the public relations department. It is for handling the media that they are paid. But public relations department expertise is seldom where the disaster occurs. Disasters are first local concerns. The local press won’t contact a PR office hundreds or thousands of miles away. The press will come to the scene of the disaster. That means they will come to you.

Anything I Say Will Be Used Against Me

In a litigious society, it is the fear of any company official that words meant to clarify, inform and comfort will come back to haunt her or him in a court of law. Therefore, the best policy, it would seem, would be to say nothing.

Yet the press can be given meaningful information with little risk of causing legal problems later. The best approach is to disclose the facts truthfully. In the case of the fuel spill in Savannah discussed earlier, the official who barred the press would have helped her company by saying something like the following (note: this is an example only):

“At 7:58 this morning, a pipe on a diesel storage tank ruptured. Approximately 10,000 gallons of diesel fuel flowed out before the leak was stopped. To our knowledge, all of the leaked fuel was captured and retained by a dike around the fuel tank, which was built just for that purpose. The diesel fuel is kept on the premises to run auxiliary generators. There has been no injuries to any plant personnel, and no damage to the environment. All other tanks have been inspected and are not damaged or leaking. We have not yet determined what caused the leak. To our knowledge, no fuel has leaked into the Savannah River. Crews trained in handling this type of disaster are responding to the spill. It is expected the fuel will be completely recovered by noon today.”

Such a statement details the facts of the situation and admits no liability, yet it does a lot to promote the idea that the company is concerned about the situation and is doing its best to promptly respond to the disaster. More importantly, the press does not have to speculate about what is happening.

How a company appears to respond to a disaster can be as important as the response itself. If the response is shrouded in secrecy, the press will assume there is some reason for secrecy — a reason that should be disclosed to the public.

If a company openly deals with a disaster and takes a little of its valuable time in explaining to the press what happened and what the response is, the dividends can be enormous.

Donald Wallbaum is a partner in MillerUpton Wallbaum, a technical documentation and communications consultation firm in Logan, Ohio. He has worked as a photographer, photo editor, reporter and publisher for a variety of newspapers during his eight-year journalism career.

One aspect of disaster planning that seems somewhat overlooked is the question, How do you fund the recovery efforts? Recovering from a disaster requires a lot of unbudgeted funds which must be spent or committed very quickly