Contingency Planning Mgmt (CPM) July 2005 Industry Insider Newsle tter - Article: "BC Lessons Learned from July 7 London Bombings"
July 20, 2005 - Despite the tragic loss of life and the hundreds of injuries from the July 7 terrorist bombings in London, some excellent lessons can be gleaned for business continuity professionals. David Honour, editor of Continuity Central, based in England, offers his thoughts and observations.
While there are many lessons that police and other emergency services will be gathering from the incident, the comments here focus on lessons related to the business continuity profession, including the following key areas:
Telecommunications
As after the September 11 attacks, communication networks failed to cope with demand. While in New York there were extenuating circumstances, with physical damage to mobile transmitters and landline exchanges, in London there were no such excuses. Mobile, landline and Internet communications all suffered from capacity problems. Mobile communications were intentionally limited to allow priority use by emergency services personnel, and possibly because of concerns that mobile phones could be used as triggers to detonate more devices. However, this placed additional pressure on conventional telecom networks as people turned to land lines as an alternative communications resource. Many companies found that incoming lines were often all in use, providing frustrating waits and busy tones for callers. Internet usage was high as people searched for information, and many companies reported that Internet access was very slow as a result.
1 Determine backup resources if land lines and mobile lines are unavailable or restricted
2 Have a way to quickly divert incoming calls to an alternate location, if needed
3 Have an alternate source for voice communications, especially if PBXs and similar systems are unavailable
4 Investigate systems that can support multiple modes of communication
Crisis Communications
Business continuity managers needed to be able to gather accurate information as rapidly as possible to pass on to staff via their crisis communications networks. However, for at least the first hour after the initial reports of an incident on the London Underground the situation was very confused. First reports focused on the incident being caused by a power surge and not until after the bus bombing did the first serious discussion of a terrorist attack occur on national media. The situation was even more confused for people milling round central London without access to any clear details of what had happened.
1 Have a way of notifying people as quickly as possible, using minimal steps to launch the message
2 Establish a way to validate information before issuing to the outside, e.g., the media
Terrorism Protection
Suicide bombing is now a real threat, not simply a notional one, for UK businesses. The only effective protection against a suicide bomber is to keep them well away from your premises; certainly no one who could possibly be deemed a threat must be allowed within the building. This will mean implementing and maintaining an effective access control system, ensuring that visitors, delivery people, or anyone unknown to the organization are kept outside the building until positively identified. Do not allow unidentified people to approach an internal reception desk.
1 Review policies and procedures for access control
2 Update access control systems and technology
3 Rearrange exterior vehicle barriers, traffic cones, and road blocks to alter traffic patterns near facilities and cover by alert security forces
4 Institute/increase vehicle, foot and roving security patrols varying in size, timing and routes
5 Implement random security guard shift changes
6 Increase perimeter lighting
7 Deploy visible security cameras and motion sensors
8 Remove vegetation in and around perimeters, maintain regularly
9 Conduct vulnerability studies focusing on physical security, structural engineering, infrastructure engineering, power, water, and air infiltration
10 Install locking devices on manhole covers in and around facilities
Human Resource Issues
For most business continuity managers operating in London on July 7, apart from the telecom continuity issues already discussed, the major business continuity headache revolved around people: tracking people down; providing information; and helping them to find the best route into work and then back home again afterwards.
1 Investigate a contingency plan that involves bringing private transport solutions (if allowed access) to a pre-agreed location
2 Investigate pre-arranged hotel rooms for staff
3 Investigate the use of alternative workplace facilities outside of metropolitan areas
4 Be sure to include human-centered activities in business continuity plans
5 Ensure that key employees have remote access if they cannot reach the office
6 Consider virtual private network (VPN) technology for remote access
7 Consider using teleconference services to maintain contact
8 Investigate call forwarding of business phones to home numbers
9 Establish a policy wherein laptop users take their PCs home nightly
10 Have network administrators and system operators perform remote system management
Issues Specific to Underground Infrastructures
Consider the potential impact of a terrorist bombing to infrastructures under the street, such as water, steam, electric, and telecom. One major concern is that different utilities are often in close proximity, such as a major telecom line next to a water main next to a high-voltage electric cable.
1 Obtain as much information as possible about collocated utility elements
2 Determine alternate routes and workarounds in case of a disaster
3 Work closely with utility companies to develop suitable and affordable contingency arrangements
Invocation Issues
When totaled up, just over 100 stand-by requests and about 30 invocations had been reported in London. The concern then becomes what happens to the backup service company that is suddenly faced with an overwhelming number of invocations.
Understand what your recovery site contract provides, especially when invoking the service
1 Clarify the sequence of response by service companies, in case you make
your invocation decision late
2 Understand the fees associated with an invocation or stand-by request
3 Consider arrangements with more than one service provider
July 20, 2005 - Despite the tragic loss of life and the hundreds of injuries from the July 7 terrorist bombings in London, some excellent lessons can be gleaned for business continuity professionals. David Honour, editor of Continuity Central, based in England, offers his thoughts and observations.
While there are many lessons that police and other emergency services will be gathering from the incident, the comments here focus on lessons related to the business continuity profession, including the following key areas:
Telecommunications
As after the September 11 attacks, communication networks failed to cope with demand. While in New York there were extenuating circumstances, with physical damage to mobile transmitters and landline exchanges, in London there were no such excuses. Mobile, landline and Internet communications all suffered from capacity problems. Mobile communications were intentionally limited to allow priority use by emergency services personnel, and possibly because of concerns that mobile phones could be used as triggers to detonate more devices. However, this placed additional pressure on conventional telecom networks as people turned to land lines as an alternative communications resource. Many companies found that incoming lines were often all in use, providing frustrating waits and busy tones for callers. Internet usage was high as people searched for information, and many companies reported that Internet access was very slow as a result.
1 Determine backup resources if land lines and mobile lines are unavailable or restricted
2 Have a way to quickly divert incoming calls to an alternate location, if needed
3 Have an alternate source for voice communications, especially if PBXs and similar systems are unavailable
4 Investigate systems that can support multiple modes of communication
Crisis Communications
Business continuity managers needed to be able to gather accurate information as rapidly as possible to pass on to staff via their crisis communications networks. However, for at least the first hour after the initial reports of an incident on the London Underground the situation was very confused. First reports focused on the incident being caused by a power surge and not until after the bus bombing did the first serious discussion of a terrorist attack occur on national media. The situation was even more confused for people milling round central London without access to any clear details of what had happened.
1 Have a way of notifying people as quickly as possible, using minimal steps to launch the message
2 Establish a way to validate information before issuing to the outside, e.g., the media
Terrorism Protection
Suicide bombing is now a real threat, not simply a notional one, for UK businesses. The only effective protection against a suicide bomber is to keep them well away from your premises; certainly no one who could possibly be deemed a threat must be allowed within the building. This will mean implementing and maintaining an effective access control system, ensuring that visitors, delivery people, or anyone unknown to the organization are kept outside the building until positively identified. Do not allow unidentified people to approach an internal reception desk.
1 Review policies and procedures for access control
2 Update access control systems and technology
3 Rearrange exterior vehicle barriers, traffic cones, and road blocks to alter traffic patterns near facilities and cover by alert security forces
4 Institute/increase vehicle, foot and roving security patrols varying in size, timing and routes
5 Implement random security guard shift changes
6 Increase perimeter lighting
7 Deploy visible security cameras and motion sensors
8 Remove vegetation in and around perimeters, maintain regularly
9 Conduct vulnerability studies focusing on physical security, structural engineering, infrastructure engineering, power, water, and air infiltration
10 Install locking devices on manhole covers in and around facilities
Human Resource Issues
For most business continuity managers operating in London on July 7, apart from the telecom continuity issues already discussed, the major business continuity headache revolved around people: tracking people down; providing information; and helping them to find the best route into work and then back home again afterwards.
1 Investigate a contingency plan that involves bringing private transport solutions (if allowed access) to a pre-agreed location
2 Investigate pre-arranged hotel rooms for staff
3 Investigate the use of alternative workplace facilities outside of metropolitan areas
4 Be sure to include human-centered activities in business continuity plans
5 Ensure that key employees have remote access if they cannot reach the office
6 Consider virtual private network (VPN) technology for remote access
7 Consider using teleconference services to maintain contact
8 Investigate call forwarding of business phones to home numbers
9 Establish a policy wherein laptop users take their PCs home nightly
10 Have network administrators and system operators perform remote system management
Issues Specific to Underground Infrastructures
Consider the potential impact of a terrorist bombing to infrastructures under the street, such as water, steam, electric, and telecom. One major concern is that different utilities are often in close proximity, such as a major telecom line next to a water main next to a high-voltage electric cable.
1 Obtain as much information as possible about collocated utility elements
2 Determine alternate routes and workarounds in case of a disaster
3 Work closely with utility companies to develop suitable and affordable contingency arrangements
Invocation Issues
When totaled up, just over 100 stand-by requests and about 30 invocations had been reported in London. The concern then becomes what happens to the backup service company that is suddenly faced with an overwhelming number of invocations.
Understand what your recovery site contract provides, especially when invoking the service
1 Clarify the sequence of response by service companies, in case you make
your invocation decision late
2 Understand the fees associated with an invocation or stand-by request
3 Consider arrangements with more than one service provider
