Planning for the “Reasonable Disaster”
Pick a disaster, pick any disaster, but which one is the “reasonable” disaster? Past commentaries have looked at general preparedness for an outbreak of H5N1 Avian Flu, or at disaster planning and response from the point of view of public private partnerships. P3 is still an area of great interest. However, one issue that has always puzzled and concerned me was the concept of gaming or modeling for disaster planning without actually knowing for which of the “all hazards” we were preparing. Of course, it can be argued that you run a model for a cyber attack to test the ability of the system to respond, or you can run one for a chemical or biological attack for the same purpose. But the series of “what if’s” that need to be considered is endless, and that leads to some interesting conclusions.
An all too often intoned quote from President Dwight Eisenhower seems once again relevant here: "In preparing for battle I have always found that plans are useless, but planning is indispensable." I’ve heard from military friends that no battle plan survives the first contact with the enemy. It is the same with disaster plans: It really does not matter what disaster scenario you are testing. The real disaster will not be like the test, regardless of what you do, so just pick one and go.
The question of preparedness and response was dealt with in When Disaster Strikes, the Importance of Public-Private Partnerships .
However, recently Bruce Schneier raised some interesting points in his article, Disaster Planning Is Critical, but Pick a Reasonable Disaster
Now, while Schneier is not an disaster response expert per se, he does raise the questions of whether preparedness for an outbreak of avian pandemic flu is a realistic need, especially since, as he concludes, most companies or organizations will not be prepared. As he wrote:
This doesn't surprise me at all. It's not that organizations don't spend enough effort on disaster planning, although that's true; it's that this really isn't the sort of disaster worth planning for.
There is a counter-argument that poses that companies and organizations should and in fact, are, preparing for an outbreak of avian flu .
But the fact is that bird flu isn’t the only potential disaster event that people, businesses and government need to prepare for.
Just what does a business prepare for? It’s actually a matter of scale. To an extent, backup systems and redundant databases - offsite data centers, temporary staffing contracts, planned degradation of services and a host of other products and services - at least compensate for the losses of primary business information during fires, floods, hurricanes, earthquakes and even a cyber-terrorism event. Schneier also notes that a fire that burns down your office building has a greater impact on your company than a citywide disaster that might have been more widely devastating. Dealing with the loss of people from death or injury, or perhaps “only” from their inability to reach the business, is similarly possible if proper systems have been put in place in advance for remote operations. What drills does a business run to prepare for a release of a chemical or biological weapon, or worse, a radiological dispersion device? Schneirer’s point of view is that it isn’t realistic to prepare for global annihilation when a return to “normalcy” is unlikely to occur quickly. But even, some less catastrophic, yet large disasters are not feasible to prepare for.
The key to all of this is preparedness. Much more important than planning, preparedness is about setting up social structures so that people fall into doing something sensible when things go wrong.
And anyone who does this kind of thing knows that planning isn't enough: Testing your disaster plan is critical. Far too often the backup software fails when it has to do an actual restore, or the diesel-powered emergency generator fails to kick in. But testing isn't just valuable because it reveals practical problems with a plan. It also has enormous ancillary benefits for your organization in terms of communication and team building. There's nothing like a good crisis to get people to rely on each other.
It really doesn't matter what disaster scenario you're testing. The real disaster won't be like the test, regardless of what you do, so just pick one and go. Whether you're an individual trying to recover from a simulated virus attack, or an organization testing its response to a hypothetical shooter in the building, you'll learn a lot about yourselves and your organization, as well as your plan.
That’s where the concept of regional resiliency comes in to focus. A program to work on regional resilience has been established at Oak Ridge National Laboratory that is designed to study the ways in which one region, the Southeastern portion of the United States can deal with a multi-threat scenario. The goal of the Southeast Region Research Initiative (SERRI) is to assist local, state, and regional leaders within the Southeast Region in developing tools and methods required to anticipate and deter terrorist events and to enhance disaster response. At its core, the basis of SERRI its belief that regional resiliency is an “economic driver.”
Resilience: a community or region’s capability to prepare for, respond to, and recover from significant multi-hazard threats with minimum damage to public safety and health, the economy, and national security.
● Prevents and mitigates cascading failures, often characteristic of critical infrastructure impacts● Minimizes disruption to life and economies.
The program involves a National Laboratory and a linkage with a number of regional universities. It also involves various stakeholders including local businesses, law enforcement, managers of critical infrastructure, emergency response and medical facilities.
While no organization can effectively prepare for a Katrina-like flood which knocks out services for months, a region can mobilize in preparation. On an encouraging note we can look at the mobilization of resources. Buses and supplies are being staged in anticipation of the now less likely direct impact of Hurricane Dean on the Rio Grande Valley.
Officials opened emergency operations centers , moved inmates to prisons deeper inland and passed out sandbags along portions of the Texas coast as Hurricane Dean barreled toward the warm waters of the Gulf of Mexico.
The Governor of Texas mobilized the National Guard and search and rescue teams, shipped thousands of gallons of gasoline to Rio Grande Valley gasoline stations, and was able to get a pre-emptive federal disaster declaration from President Bush. The Texas Criminal Justice Department has even relocated inmates from three institutions inland. So it seems like at least some lessons were learned from Hurricane Katrina. The question remains however. What disaster do you prepare for, and when will it strike?