Response Mode

Brent Woodworth is a worldwide segment manager of IBM's Crisis Response Team. He's coped with earthquakes, floods and a host of other disasters. One thing he's learned is that it pays to be prepared.

by / May 1, 2002
Government Technology: How did IBM get into this line of business?

Woodworth: For a number of years, IBM has looked at the area of providing some type of security and protection to help its customers prevent disasters and recover from them quickly.

Back in 1989, IBM announced that it was in what you would call the "hot-site" business -- the recovery business. That business was primarily focused on providing key customers with an alternative that if they lost equipment, or it was damaged, destroyed or inaccessible, they could come run, if they were subscribed to the service, at one of the designated IBM sites.

As time progressed, one of the things we looked at was that just protecting the IT infrastructure, the network infrastructure, is really not enough. If a company is going to survive through difficult, crisis times, you have to look at a full measure of business-continuity protection; in essence, looking at everything from protecting employees -- clearly the most valuable resource and asset a company has -- through the company's reputation, through the facilities the company has, their operations, their interaction with the local community. The IT operation clearly is important, but all types of financial and operating functions need to be examined.

Our first real experience in responding to a major disaster came in January 1994 with the Northridge earthquake in Southern California. Ever since then, we've been extremely busy.

The crisis team as a whole, to give you a little background, really performs three major functions. One of them is working with commercial customers, local, state and national governments to help them prepare, mitigate, respond to and recover from a major disaster. We do a lot of those things on a fee basis and on a retainer basis.

Our team also works very closely internally with all of our risk and insurance management teams worldwide, and we also provide this type of protective service and response, recovery and planning services for IBM's plant sites in critical locations throughout the world.

Finally, the last piece of what we do is humanitarian type of relief and response. That came about through some conversations I had with our corporate community-relations folks in looking at IBM's very positive, over the years, response to worldwide disasters and wanting to be a very good corporate citizen in providing help and services.

For a long time, we donated funds and provided some equipment, but we didn't necessarily have a direct team that could come in and help manage that recovery effort. The IBM Crisis Response Team took on that responsibility and is now dispatched worldwide when invited in by those countries to provide humanitarian relief services, at no charge, to those governments in need during a time of crisis.

GT: There are obviously different situations at each incident you respond to. Are there some similarities in those situations as well?

Woodworth: Yes, there are similarities in the disasters and the type of issues that you face in each one. We've seen a wide variety of incidents, ranging from hurricanes to floods to landslides to volcanic eruptions to civil unrest to war to acts of terrorism -- such as Sept.11 in the United States and the Oklahoma City bombing -- and to massive earthquakes, which seem to dominate as far as large-scale disasters are concerned.

There are similarities in how the response works in countries that have limited financial means, in Third World countries per se, and in the United States across the board as far as what the needs and requirements are. They range from the basic needs of food, water and shelter through needs associated with technology services, management of the disaster itself and developing and implementing systems that will help people make intelligent and well-informed decisions in an organized manner to be able to reduce the level of suffering, reduce the damage and accelerate the recovery effort.

Also, we see some consistent levels of communication systems and communications infrastructure. In many of these major disasters, the telephone lines are down; the communications services are severely disrupted; the lifelines -- things like water supply, sewage and power -- are destroyed or heavily damaged.

The governments involved are often overwhelmed by the massive volume of damage and how they can respond to the disaster. Other challenges we see come in handling the donations that come in, especially in foreign governments. Once a disaster occurs, you're looking for help to come in from other governments. They'll provide food, water, shelter and medicine that comes in by the plane load, by the ship load or by the truck load, and you now have the logistical challenge of receiving it, distributing it, managing it and sorting it so that you can get it to the victims as quickly as possible.

One of the challenges we see, especially in foreign governments, is that you may be receiving goods from 60, 70-plus countries in more than 30 or 40 languages. How do you interpret all of that? How do you change your customs regulations to allow these goods to come in and flow effectively? How do you track and manage it?

GT: I would venture a guess that the needs of a foreign government versus a company that you've contracted with are quite different.

Woodworth: There are differences depending on the scale of a disaster and how granular you get. It is different when you look at a single company and the needs of that commercial entity versus the needs of a community or a country. The scale is different.

I will tell you that the trauma is there in all disasters. They all face the issues of trauma to the employees or to the community. The effect of trauma often reduces the ability of people to perform tasks at their pre-disaster level. Most of us, in our daily lives, keep three or four things up in the air that we always balance, and when a disaster hits, one or two of those tend to fall down because the trauma may affect you very personally. Your family, your loved ones could have been harmed. Your home could have been damaged or destroyed. That is common from the small corporation to a community in times of disaster.

Another common factor is information; the lack of information to make decisions. Information, as Mike Armstrong, one of the prior directors of mitigation for FEMA, used to say, is just as important as food or water in a disaster. You cannot over-communicate in a disaster, and you need proper, accurate and timely information to make decisions on how to respond and how to recover and protect your reputation, whether you're a business or a community.

The communication issues are major. They can be compromised and damaged and the disruption can affect the ability of a community to correspond. But the business issues are a little different in the area that you're now worrying about: How long can I be without full operation? How long can I be away from my business? Or not be in full function before I face significant financial hardships or potential bankruptcy?

For most small and intermediate businesses, if you close your doors for more than five to seven days, the odds of your never opening are greater than 50 percent. You face a significant challenge in being able to relocate operations to sustain yourself. If you're a large multinational or if you're one of the Fortune 1000, you have many locations and you may not face that challenge unless a key, critical facility is heavily damaged.

But for the smaller, average-sized business, the local restaurant, dry cleaner, smaller store, law firm or consulting firm, once those doors are closed for any extended period of time, they may never reopen. That's a challenge. They also face similar logistical challenges to the community in getting supplies, equipment and personnel back to work.

I mentioned the Northridge disaster earlier, and there was approximately $15 billion in insured loss that was covered. But there was almost an equivalent loss in productivity and people not returning to work following the disaster. Or, when they did return to work, their level of productivity was severely degraded, so the businesses sustained additional losses that weren't necessarily covered by insurance.

We look at the social, economic, environmental and political impact, and those things you associate with countries, but they can also be associated with businesses.

GT: You mentioned protecting your corporate clients' reputation in a time of disaster. How does that translate to a government customer? Is it more about protecting the citizens' perception that government can continue to function?

Woodworth: You're protecting the reputation of a city. The elected officials are going to worry about their responsibility to their constituents as to what can be done to reassure them and to support them during a time of need.

Mayor [Rudy] Giuliani did an excellent job of helping to deliver peace of mind, direct information, support and organization and management of the Sept. 11 disaster. When we talk about reputation, obviously he had a very fine one, but he also had a strong reputation in managing those departments to be most effective in responding to the disaster.

The result is that after the terrible, unfortunate events of Sept. 11, when you step back - did New York City do a good job in managing it and recovering from the devastating effect? Yes, they did. They did a great job. Do the people in New York City that are part of that community support their government leaders in moving forward in the work that they've done? Absolutely.

It's a good example of doing many of these things the right way.

GT: Do you see common mistakes being made by organizations, whether they be private or public sector, before a crisis happens that impedes their ability to react to that crisis?

Woodworth: One of the challenges we've seen over time is overcoming the issue of denial. Many people, for years, have always believed that the disaster is going to happen to somebody else. As a result, they don't put a full effort into their areas of planning and testing and managing business continuity or community continuity

You should emphasize those efforts in a couple of areas. One of them is to go in and conduct an initial vulnerability assessment to understand your true risks; your potential single points of failure, both from a physical standpoint and a logical and operational standpoint. Look at all those in detail, and get some professional help to come in and do that.

Once you've identified those risks, then develop a plan to mitigate them, obviously balancing cost against the reasonability. In New York, for example, trying to build a wall around the city to protect against a tsunami is probably not economically viable or a good way to prevent that risk. In almost any facility, having smoke detectors and sprinklers, that is a good expenditure in reducing that risk.

You look at a vulnerability assessment; you look at the mitigation; then you look at all these preparedness issues, which includes developing a comprehensive plan. That plan needs to cover all facets of your business or the community. You look at the employees; you look at the operations; you look at issues such as, if a disaster occurs, what about relocation? What type of insurance do I have? What type of coverage is available? Does it make sense for me to buy more? Does it make sense to increase my levels of mitigation?

Then there are transportation issues; critical resources; if you're the government, there may be political issues; there's worrying about the schools, hospitals, elder-care centers, the response of fire, police and trauma management and so forth; these all go into understanding a complete continuity plan. Information technology is also vital to many businesses and to many communities to be able to do the proper tracking, analysis and management of these functions.

Once you've done that plan, you need to test it. In testing the plan, you do a simulation, and you go through the full process of seeing what has to be done. It's not a pass-or-fail exam; it's a learning experience. But it needs to be done on a regular basis, and what you learn should go into your plan to update it.

If you find that your evacuation procedures aren't quite right; maybe they should be updated. If you find that, from a full recovery and restitution standpoint, you're missing some skills and there's a lack of linkage between departments or a stove piping of critical information, fix those things. Test your systems; test your IT recovery capability; test your communications issues, and so forth.

Once you've done all that, and you have a regular routine of identifying, mitigating against risk, being prepared and working with your employees and your constituents, then you're pretty well prepared.

GT: In your work with state and local governments, have you seen a common thread of un-preparedness? Did the levels of preparedness you found surprise you?

Woodworth: We see varying levels, based on the commitments in those cities or communities to the area of disaster preparedness. A number of folks have, in the last few years, warmly embraced some of the pre-disaster mitigation programs led by FEMA, such as Project Impact, which focused heavily on improving the awareness of the public sector to the risk of disaster and putting [in] place plans and practices that mitigate from both a structural and a non-structural side to reduce risk.

There are quite a few communities in the United States that were very active in that, and around the world as well. In general, U.S. communities would rank among the highest as far as those who are prepared, compared to several other countries.

That doesn't mean we need to sit on our laurels. There's still a lot to do in many of these communities, especially in light of the tragic events of Sept. 11, which have shown us that a low-probability but extremely high-consequence disaster can have devastating effects.

Now, you have to look at things that, in the back of your mind, you hope would never happen.

GT: What sort of lessons can the public sector learn from the private sector?

Woodworth: Part of it is in sharing resources. I believe that a lot more can be done, though much has been done already, in working in a cooperative basis between the public and private sectors. There can be more done as far as sharing of resources in catastrophic events; learning lessons across the board from what works and what doesn't work in a disaster.

We've been to more than 70, and what I would observe is that Mother Nature never reads a disaster-recovery plan and this guy Murphy shows up to every one of them. Having first-hand experience in one, it becomes a lesson that teaches you that if this was to occur in your city or affect your business, having seen it or having gone through it before, we might be able to find some of the pitfalls or some of the challenges that you had not seen or had not faced.

New York took advantage of that kind of knowledge following Sept. 11 and asked for help from a number of private-sector agencies, including IBM and others, to work closely with them to provide advice, counsel, support and services of a wide nature, all of which came to play to help both the response and the recovery effort work more efficiently.

Can things be done even more effectively in the future? Sure, things can always be better. But I believe there's a lot we can share with each other. We've had that experience overseas in working with many of the U.N. organizations, such as the World Health Organization, UNICEF, UNHCR and many others, in this sharing between the public and private sector of some of our methodologies, technical skills and experiences in disasters combined with theirs.

When we put those two together, we're far more responsive to the needs of the victims. We can be more efficient. We can reduce cost, and, most importantly, reduce suffering.

GT: I'm curious about your perspective on how different levels of government work with each other within this country. Has it improved over the last couple of years?

Woodworth: From a congressional standpoint on down, we've seen some improvements. The country had a severe shock years ago after Hurricane Andrew, when, in response to the hurricane, from a federal government standpoint, the strength of FEMA as it is today didn't exist.

As a result, the state had to be far more self reliant -- not that that's a bad thing -- but the positive aspects of what the federal government could do in assisting the state weren't there to the extent they are today.

Since that time, we've seen vast improvements in the areas of emergency management; in the skills and capabilities of the emergency-management directors throughout the states and the cities and the counties. I've seen more and more exercises and more and more sharing of information, philosophies and better ways to do things.

We've seen significant enhancements in the use of technology to support decision-making and to help rescue efforts. It is moving in a very positive direction, and I would hope it continues to do so. This development and embracing of public/private partnerships is just one facet of that growth that we'll continue to see in a positive light.

GT: It can't be one sector or the other, can it? It has to be both.

Woodworth: It has to be both, and it has to cross multiple government agencies. It can't just be FEMA. You also have the Department of Commerce, the Department of Defense, the Office of Homeland Security -- you have many, many different groups within the beltway that are involved in looking at these types of capabilities and services.

You have the awareness of a lot of senators and congressmen who are very direct in the need and requirement and desire to continue this effort.

GT: Is there a particular technology that helps more than other types of technology?

Woodworth: IT services and communications technologies are continuing to advance. In the case of the Sept. 11 disaster, one of the advanced technologies that was used was wireless communications. Specifically, the BlackBerry device became the de facto standard that was used by Mayor Giuliani's direct reporting staff, by Gov. [George] Pataki and by organizations such as the Red Cross for sending secure information back and forth

That was later enhanced significantly, as it is used now, to include the ability to enter reports on the status of buildings. One of the challenges in New York City was that when that much real estate is damaged or unavailable, what you want to do is get people back in their homes in a safe and secure manner as rapidly as possible. The same thing with the businesses -- get them back in those buildings once they are safe and secure.

For the mayor or the key personnel to make those decisions, you need sign off from many departments and you need to make sure it's safe. So building inspectors had to go out and take a look at the buildings, and they were looking for different components, such as hazardous materials, power, telephony and so forth.

Before, they used to fill out paper reports. Now, it's automated so they can actually use handheld devices and literally key in the reports while they're in the buildings. What that does is shorten the time for the decision to be made to go ahead and re-occupy the building.

That's a technology that was very, very effective, and it's just one example. There were many others.

GT: Refinements will just keep making it better.

Woodworth: We'll see more devices and technologies that will help. But I will also caution people that technology is wonderful, but in major disasters, you need to also have the methodology and ability to operate without it.

In large, catastrophic disasters, some of the technology that we depend on, such as the Web, may not be available. You may not have power. You may not have your normal supply of water or access to sewage systems. Those may be heavily damaged, and, if they are, you need to find other means to operate.

When we responded to the earthquake in Turkey in August 1999, we didn't have the normal resources available. When it came to cataloguing medicines, we had to get creative. We categorized them using colors; antibiotics were a blue triangle, analgesics were an orange circle. We had so many languages and so many challenges in linguistics; we found another way to get around it.

We also used disaster-resistant technology; technology and software that's very robust that allows for you to operate in a standalone mode or in a connected mode. Information can be shared on a very rapid, replication basis if you're connected. But if you're not, you can still continue to do your job. That was technology that was used not only in Turkey, but also in India after the massive earthquake there.