Thoughts on the Trade Center Bombing

By Wayne Lewis, CDRP

It is now two weeks since the bombing of the World Trade Center Tower. Like most, I was saddened by the loss of life and the destruction that was caused directly, or has resulted from that event. But from all the bad news there may be some good. As a Certified Disaster Recovery Planner I was heartened by the media coverage of ramifications to business because of the bombing.
Because of “media fascination,” we were bombarded with these consequences to business. Coverage ranged from the radio announcements by large accounting firms urging their staff to check their voice mail, to disgruntled executives expressing their anger that they could not get access to the building because they lacked sufficient identification.
The sight of staff packing computers, software and vital records on trolleys to move them to alternate locations was coverage that we as CDRPs could never have contrived, as a means of demonstrating what should not happen.
One shudders to think of the consequences to businesses if tenants are not to be allowed to gain access to the building for one month or more. How many of the companies in this prestigious building would, or could survive?
During the many hours of news footage I remember a few frames picturing an alternate site where up to three people were going to share work stations. But did you hear one employee complaining that there was no photocopier?

Alternate sites must have the capacity to handle the number of people with all the necessary modern business tools. Office space is often a real problem logistically, and very costly when we relocate a large number of staff. The classification and prioritization of job functions (essential, support and clerical) is a must if we are to optimize available space and facilities. We pay to use office space 24 hours a day, so why not have it occupied accordingly, especially during a crisis, or recovery period?
Perhaps essential staff could occupy a space from 8-5 p.m; support staff could take over from 5-11 p.m.; and clerical staff from 11-6 a.m. Such a plan would ensure that everybody could perform their tasks and contribute to the survival and smoother running of an operation rather than three people trying to function at one workstation for just eight hours in a day.
As a result of the bombing and its consequences, more executives will now realize it is not sufficient to have disaster recovery plans in place just to cover computer outages. They will hopefully also realize that disaster recovery is a corporate-wide issue and covers the total environment in which we operate. Many acknowledge the principles of “quality” in management and its importance, but don’t follow through to include the same quality in disaster recovery plans.
The incident has given us many important lessons, e.g. developed disaster recovery plans are useless if you must re-enter an unstable environment (building) to recover vital records and equipment. Your equipment and records may be undamaged, but if you cannot enter a building to use them and have no contingency plans to cover such an event, you are in the same situation as someone who has lost a whole site.
Also what is the use of having an alternate site if you have insufficient space to house your staff? We can plan for contingencies, but what are the consequences if staff are unwilling to enter a “dangerous site” to recover vital records and equipment?
The human reaction factor must be addressed and must include the consequences of a sudden evacuation and subsequent lock out, as well. What will “the company” do to help those staff who leave their apartment keys and personal effects behind in the rush to evacuate a building? What assistance would you give those staff members who left wallets and purses in their lockers? Are these aspects covered in your disaster recovery plans? These individuals will not be in a position to work effectively if emotionally upset.
Do you know who occupies the floor directly above or below you, or to each side? Do they store or use flammable liquids or gases?
Although we can plan for contingencies by using emergency power etc., we must remember that it is just an element in a contingency plan, and when the time comes for some reason (perhaps water damage, fuel problems) it may simply not operate, or operate for as long as we expect or not operate at all. Constant maintenance and trial running of backup equipment is a must!
Before you rely on any essential element in your plan, undertake a risk analysis to assess inherent vulnerabilities. Only then will you know how reliable your alternative is. You can then either accept the vulnerability and plan accordingly, or build a plan which does not rely heavily on its availability.
It is always a good lesson to undertake a review of the disaster recovery plan after such recent events to ensure that we do not have similar vulnerabilities in our plans. If possible try to call a meeting of key players, to discuss what we have all learned from the bombing and subsequent events, remember it may not be practical to remove identified vulnerabilities, we can go a long way to ensuring profitable corporate survival if we simply identify them in disaster recovery plans.

Mr. Lewis, CDRP, is a consultant with Global Consulting Group Inc. He has international experience in disaster recovery/business recovery planning. He is also a trained facilitator in the Swedish Risk Methodology “Security by Analysis.”

This article adapted from Vol. 6 #2.

Disaster Recovery Worldİ 1999, and Disaster Recovery Journalİ 1999, are copyrighted by Systems Support, Inc. All rights reserved. Reproduction in whole or part is prohibited without the express written permission form Systems Support, Inc.