Long-term Disaster Planning Pays Off

Any organization experiencing early success can become complacent and can make bad decisions after reaching their pinnacle. Clearly, this can have lingering consequences. Under such circumstances, the organization must be forward-looking, and not hope to rely on divine intervention.

Underscoring the need to have a solid business continuity plan to ensure ongoing operations, this requires:

1. forward-looking management that sometimes may need to make tough decisions that might alter the culture of the organization
2. a sound facility strategy
3. a sound plan to remain operational in the event of a disaster
4. persistence in execution and managerial skill even when it looks as though all is lost
5. a recognition that customers come first, and their needs must be addressed in the event of an unscheduled disaster

If these measures are logical enough, they can even be carried out by a bunch of idiots, and there’s a good chance that at some point – even 86 years in some instances – the payback on that strategy will be realized.

The Impact of Rule 446

In June of 2004, the SEC approved a pair of nearly identical measures that mandated business continuity planning measures for financial sector participants - this had acutally been in the works for some time. The NYSE adopted a version called Rule 446 and the NASD came out with Rules 3510 and 3520. The new rules require members of these organizations to adopt business continuity standards. This is significant because as more and more firms look to adopt some kind of business continuity plan, they often find themselves having little idea where to start or how long the process might take. These rules begin the needed process of developing some kind of standardized way to approach BCP. The implications of these rules will undoubtedly be felt in other sectors.

In fact one of the main beneficiaries of these rules will be small to medium-sized enterprises (SMEs), who until now are saddled with the need to adopt business continuity planning programs, but lack the resources to hire full time risk managers. The need for SMEs to adopt business continuity protocols will be driven by a number of factors, including legislation, but in the short to medium term, this will also be driven by the need to comply with stricter underwriting standards in the insurance industry. A few facts from this article are noteworthy:

"A significant number of randomly selected firms did not have business continuity plans. Of particular concern, many smaller and midsize firms did not store backup data and systems in a separate geographic location from primary systems and records"

"Many smaller firms that typically focus more exclusively on recovery of the IT environment than on recovering all critical business processes may face substantial work to expand their plans to meet new standards"

We'll be keeping a close eye on how SMEs keep up with a whole lot of change that will be coming down the pipe over the next several months.

The Mathematics of Terrorism

An ordered-set representation of a
terrorist cell, where Members A, B, and C
are leaders and rank higher than all other
members
Source: www.sciencenews.org

One of the underlying problems the insurance industry has to deal with in a post-9/11 world is an ongoing inability to frame the probability of terrorism within any statistical model. I was listening to this piece on CBC's The Current this week and it discussed some very interesting ways in which mathematical theory is being applied to counter-terrorism.

Kathleen Carley from Carnegie Mellon University was discussing how graph theory is being applied in identifying the holes, vulnerabilities and and strengths within systems, and Massimo Marchiori from MIT spoke about infrastructure vulnerabilities due to terrorism.

Despite the logical structure, there are limiations according to mathematician Jonathan D. Farley of MIT as quoted in this piece:

"Our view is that modeling terrorist networks as graphs does not give us enough information to deal with the threat," Farley wrote in a recent issue of Studies in Conflict and Terrorism. "Modeling terrorist cells as graphs ignores an important aspect of their structure, namely their hierarchy, and the fact that they are composed of leaders and followers."

Farley believes a more robust depiction of networks can be represented by using basic principles of order theory, an approach also advocated by Fred Roberts of Rutgers University who spoke about its characteristics on The Current. Roberts also talked about a recent conference where a small group of mathematicians (including Dr. Farley) gathered to discuss counter-terrorism measures using mathematical principles such as complex systems theory.

Terrorism takes brains. You don't need political influence, military might or economic resources to plant bombs or take hostages; but without brains, terrorism is nothing more than random violence.

The theme of all this, I suppose, is that before we throw in the towel assuming certain nuts just can't be cracked, help is on the way, in fact lots of it to boot. I can't help but think of that familiar line so many of us used to throw at our parents when they told us we should be doing better in math - "Yeah, but what could I possibly do with math anyway?" - if they just were born a little later, I'm sure they'd have a much snappier retort.

World Series Winner to Determine Presidential Election

Forget the polls, the pundits and the partisan hacks, here's how we'll decide who wins the Presidential election in the event of a tie in the electoral college votes.

The way I see it, it's Kerry from Massachusetts against Bush from Texas. I'm calling upsets here, and that seems to be telling me it's gonna be the Bosox against the Astros in the World Series. I'm not a Red Sox fan during the regular season, but I've become a big fan of Edward Cossette over the past year.

If there's a tie in the electoral college votes for President or if, for whatever reason, the voting machines don't work or chads hang, we won't go to the Supreme Court for a decision this time. Litigation is so divisive. Let's play ball. Baseball is the American game. So, if the American League team wins the World Series, it's Kerry for President; if the National League team wins, it's four more years of team Bush--unless either candidate wins the election decisively.

Are we ill-prepared for pandemic influenza?

America was a nation at war.

In September of 1918, soldiers at an army base near Boston suddenly began to die. The cause of death was identified as influenza, but it was unlike any strain ever seen. As the killer virus spread across the country, hospitals overfilled, death carts roamed the streets and helpless city officials dug mass graves. It was the worst epidemic in American history, killing over 600,000--until it disappeared as mysteriously as it had begun.

It was like a horror movie.

It's been 35 years since the world experienced a flu pandemic, the Hong Kong flu of 1968-69. And it, by pandemic terms, was a mild one, killing only an estimated one to four million people in the developed world.

So many of us don't have a clue what a flu pandemic would be like. Getting a picture of what it could entail might make it easier to understand why the World Health Organization and governments around the globe are desperate to keep the current avian influenza outbreak from sparking a pandemic among humans.

Let's put it this way: When it comes, it won't be pretty.

We've been warned.

Following are some facts about pandemic influenza:

WHAT IS IT? A flu pandemic happens when an influenza virus that hasn't circulated before in humans emerges from nature. No one has immunity and millions around the world get sick.

HOW DOES IT HAPPEN? A pandemic flu strain can be created two ways. An existing strain can mutate; flu viruses are prone to mutation. Or an animal virus can reassort or mate with a human flu virus, acquiring the ability to spread from human to human.

HOW OFTEN DOES IT HAPPEN? On average about three times a century. In the 20th century, pandemics occurred in 1918-19 (the Spanish flu), 1957-57 (the Asian flu) and 1968-69 (the Hong Kong flu).

WHO GETS SICK? In regular years, the very young and very old are hardest hit. But that's not necessarily the case during pandemics. The death toll for the Spanish flu was highest among people aged 25 to 34.

HOW MANY LIVES COULD IT CLAIM? That depends on the severity of the strain. The Spanish flu killed an estimated 20-to-50 million people; the Hong Kong flu, a mild strain, killed between one to four million people in developed countries. The WHO predicts the next pandemic could kill between 280,000 and 650,000 people in the developed world. Health Canada predicts 11,000 to 58,000 deaths in this country if a vaccine cannot be developed.

WILL THERE BE A VACCINE? The WHO, in conjunction with manufacturers like Shire Biologics of Canada, will work feverishly to produce one. But there are no guarantees a vaccine will be available in time to protect large portions of the general public.

It's a good thing the government has everything under control.

Dr. Julie Gerberding, director of the Centers for Disease Control and Prevention, said it's too soon to tell if there will be a flu crisis this year.

"Well, we're just at the beginning of the flu season, so we can't predict whether this is going to be a serious year or not," Gerberding said Monday. "We have 20 million more doses of flu vaccine to get out there, and our goal is to get those doses to the people who need it the most before the season really speeds up."

The shortage also has become an issue on the campaign trail, with Democratic candidate Sen. John Kerry blaming the Bush administration for not paying attention to warning signs about possible shortages and the Bush campaign inferring that vaccine manufacturers are hindered by fears of lawsuits, something the campaign said Kerry would not move to fix.

"I'm sorry that this is becoming a political issue. This is really a health issue," Gerberding said. "I think the bottom line is that the administration has requested a great deal [of] increase in the support for influenza.

"We have a stockpile. We have more drugs than we've ever had to treat this condition. I feel like we are taking responsible steps, but we need to solve the problem with the vaccine manufacturing and that's a problem that's been 25 years in the making."

Gerberding said vaccine manufacturers need "a guaranteed market, they need a fair price and they need liability protection."

Does that sound like the CDC might be engaging in the political debate?

Both candidates for President of the United States indicated in the presidential debates that the greatest threat to national security is the potential for nuclear proliferation in the hands of terrorists. I guess that could change.

Hazel's Legacy - 50 Years On

This is an appropriate day to take stock in the quality of emergency preparedness measures we often take for granted. It is appropriate because on Saturday, October 16, 1954 - fifty years ago to the day, a sleepy Toronto wakened to the sight of a disaster on a magnitude that could never have been imagined. It was the morning after the remnants of Hurricane Hazel whipped through the city killing 81, and leaving hundreds of millions (in today's dollars) of damage.

From my standpoint, this is not as much about why Toronto suffered so such destruction, as it is about how far we have come since that fateful day. To begin with, Toronto was susceptible to the effects of Hazel because of its geography and population. The city is centered at a point where four large rivers empty into Lake Ontario, and on that night, the death and destruction wasn't caused by excessive wind speed, but as a result of massive flash floods that swept through residential areas that had been built on floodplanes (there was, in fact an entire street - Raymore Drive - that was swept away when the banks of the Humber river overflowed).

Even before realizing this was Hazel's 50th anniversary, I was playing golf earlier in the week at the Don Valley Golf Course, and turned a mediocre round into a good one as soon as I hit the 12th hole - a long straight par 5 that runs parallel to the nearby Don River. As I was walking down the fairway of the course where I learned to play the game as a kid, I was reminded of something that happened a long time ago when I happened upon a manhole cover in the middle of the fairway that inexplicably reads '1927.' As a local, I remembered the significance immediately - it used to sit right in the middle of a street that was washed away by the storm. This gave me the itch to re-read a book I had read more than 20 years ago simply titled "Hurricane Hazel" by former Toronto broadcaster Betty Kennedy. In it she describes a city that was utterly unprepared for any kind of disaster, let alone a catastrophic flood.

There were three primary reasons for the death and destruction:

1. Vague Meterological Information and Limited Media Reach - The following was the official forecast issued by the weather office in Toronto at 9:30 p.m. on Friday October 15 (about two hours before the storm struck):

Rain tonight. Cloudy with occasional showers Saturday. Little change in temperature. Winds north 40 to 50 this evening decreasing overnight to northwest 30 Saturday.

2. No definable building code prohibiting construction on floodplains - at the time residential areas built on the shores of rivers were common, today, all of these areas have been transformed into parkland.

3. No organized civil defense department or structured emergency services - here are two exerpts from Kennedy's book that really drive the point home:

"Toronto was without a civil-defence unit. There were about forty auxiliary policemen who had signed on for a new training plan, but were not called upon as a group because they had absolutely no equipment"

East of Toronto, the Rouge River was in full spate, very different from the placid stretch of water Ted Ryan thought he knew: "Shortly after 10:00 that night the phone rang. It was my friend and neighbour, Fred Hunt. He asked me if he could borrow my auto-top boat which we used for duck hunting as he had gotten word at the corner store ther were one or two families stranded in the lower Rouge River due to flooding...I asked him to wait for me there until I got more appropriately dressed...there was no way I was going to miss out on this adventure as the Rouge areas was quite rural at this time and this sort of thing was one of out pleasures...Of course, I had in mind that we would serenely cruise down the river and, with some luck, possibly rescue a damsel in distress"

Next time we find ourselves thinking about how the need to shore up the emergency preparedness infrastructure, think about how much better prepared we are today compared with 50 years ago. We've come a long way from the days when our primary motivation in disaster management was rescuing damsels in distress.

Congress delays action on TRIA until 2005

Just as it seemed as though lawmakers in the U.S. were on the verge of extending the Terrorism Risk Insurance Act (TRIA) - legislation that ordered the insurance industry to offer terrorism coverage while creating a federal backstop for substantial losses - just two weeks ago, it seems as though the House of Representatives has decided against scheduling action on TRIA before Congress recesses for the year, thereby putting this off until 2005. With a year left before expiry, there are some who are starting to worry.

As the clock ticks down on TRIA (it is slated to expire at the end of 2005), some insurers are already being told to prepare contingency plans, just in case TRIA expires:

"Since the reauthorization of TRIA for periods after Dec. 31, 2005 is still uncertain, it is important to prepare now for both a hard and soft landing when TRIA terminates...Companies should make sure that in an effort to limit their long-term exposure, they don't take any legal missteps in the urban arena"

The rippling effects of non-action could be significant, as suggested in a September 2004 report co-authored by R. Glenn Hubbard, dean of Columbia University's Graduate School of Business, and Bruce Deal, managing principal at strategy consulting firm Analysis Group Inc.

Just allowing the Terrorism Risk Insurance Act of 2002 to expire could potentially reduce U.S. gross domestic product by 0.4 percent ($53 billion); reduce household net worth by 0.9 percent ($512 billion); and reduce job creation by 0.2 percent, (about 326,000 jobs)

It seems reasonsable to assume that given the given the consequences of not resolving this complicated issue, it will be resolved, but really now, let's get on the program people.