About the same time that the National Science Foundation announced a doubling of Category 4 and 5 hurricanes worldwide in the last 35 years, Rita drove the point home, becoming the second Category 4 hurricane to threaten the Gulf Coast in a three-week span. Although it was a 3 when it hit land, Rita reinforced—if anyone had any doubts after Katrina—the need for businesses and governments at all levels to ramp up their emergency response capabilities.
Katrina revealed the extent to which emergency response planning fell short, as well as some areas where plans worked well. The following series of articles looks at the challenges that confronted businesses immediately after Katrina, and how the lessons learned from those experiences may shape future policies.
Engulfed By Disaster
By Sherry L. Harowitz
——————————————————————————–
Back to Page 1
——————————————————————————–
If one had to sum up the Katrina response in one sentence, it might be this: Neither the multiple governments involved nor most of the many private companies affected had adequate plans in place to deal with the disaster—but once the magnitude of the crisis became clear, private industry was much more nimble in reacting to the situation, both in helping employees and in dealing with asset protection and business continuity.
People First
It’s only natural that much of the early media attention centered on the thousands of stranded people in New Orleans who weren’t getting timely help from the authorities. Many others, however, were getting a great deal of immediate and extensive assistance—not from government, but from their employers, who really did put their people first.
“First and foremost, in a disaster situation, you have to make sure your people are safe, and then you have to protect your property,” says Lawrence K. Berenson, CPP, security director of L-3 Government Services, Inc.
That was consistently the message from businesses that spoke with Security Management about their response to Katrina. Achieving either objective was easier said than done, however.
Marriott International, Inc., had 15 hotels in the New Orleans area—11 downtown were affected, with flooding in three of the locations. When the flooding began, 2,300 guests and employees were still in those facilities, says Chad Callaghan, CPP, vice president of enterprise loss prevention at the company.
Through the efforts of one of his regional loss prevention directors, and with some advanced planning, they were able to get buses and a state police escort to evacuate those people within 48 hours.
That was only the beginning of the company’s efforts on behalf of employees. J.W. (Bill) Marriott “quickly made a decision that we were going to set up a center in Houston,” says Callaghan. From there, staff would try to locate displaced employees and help them find housing and alternative employment. Marriott also decided that employees would be paid through September.
Other companies took similar steps. In the immediate aftermath, “we set up a number of employee hotlines for companies so that their employees could call in,” says Bruce McIndoe, chair and CEO of iJet, an enterprise risk management and crisis response service provider. “We would check people off, get their health status, understand what their needs were, where they were, and did they know about other employees.”
McIndoe notes that most companies didn’t have any structure set up for handling these issues before Katrina struck. “They were kind of reacting to it in real time,” he notes. But “all of those clients are now looking to institute those [hot]lines permanently so that they have them in an emergency and don’t have to scramble again.”
Similarly, many clients are now talking with him about setting up permanent backup emergency communication systems, such as with satellite phones, to ensure that next time they will have communications with key staff in locations where phone services go down.
iJet worked with about 20 companies in the area, ranging from chemical plants and grain elevator and storage facilities to banks and medical service providers. McIndoe notes that, like Marriott, the companies he worked with “have been very good about continuing to pay salaries to all employees even though operations shut down.”
The story was the same among security service providers—struggling simultaneously with their own employees’ hardships and increased demands from clients in the area. AlliedBarton, for example, which had about 100 employees in Louisiana—55 in New Orleans—arranged to pay employees whether they could work or not for several weeks after the disaster.
“In the case of the officers that were displaced, if they did not identify or locate housing in a timely fashion, we provided housing for them, and we provided continued employment out of Baton Rouge,” says Mark Porterfield, vice president and general manager of government services for AlliedBarton. “For those relocated out of state, we have made every effort to reach out to them to make sure they received their pay and to employ them in those states.”
Johnson Controls, which had 350 employees in the affected area, took similar steps. The company set up a toll-free phone line that employees could use to check in and share information. In addition, it made a $1 million contribution to the American Red Cross and set up a way for coworkers to donate to a fund or contribute items through a Web site where they could match needs of those affected.
And when the company realized that replacement housing was impossible to find, “we bought RVs in Wisconsin and immediately started shipping them down to the campgrounds” for employees, says Eric Reisner, vice president of strategic programs and point man on Katrina response for Johnson Controls.
Of course, the efforts to help employees—though generous by any measure—were not entirely altruistic. Companies needed staff to get their operations up and running. That need has also led to some interesting service provision opportunities for businesses. For example, Johnson Controls has found that companies in many of the vertical markets that it serves, such as healthcare and schools, now need basic support services for employees that cross over these markets.
For example, a university wanted to know how to set up a charter school for its employees, and a hospital wanted to offer daycare for staff because otherwise they wouldn’t return to work before such services became available generally in the area. “We can help with that. We’re actually kind of a matchmaker between our vertical markets now,” says Reisner.
Similarly, IT departments at some of the companies that iJet was working with were trying to figure out if they could set up remote work centers in Baton Rouge or another nearby area, says McIndoe. They are just looking for any way possible to get employees “back contributing to the company.”
Self-Sufficiency
One important lesson cited by those interviewed is the need for a company to be prepared to fend for itself in the early days of such a severe crisis. They should be able to handle evacuation, asset protection, and recovery efforts with little or no help from the government.
“You can’t count on the authorities,” says Callaghan. “If your plan has primary response by the authorities, you’d better have a backup plan,” he says.
Callaghan learned that the hard way in the aftermath of Katrina. “I was very surprised,” Callaghan says. “I really had great expectations that the state and federal and local governments had procedures in place to deal with this, and we quickly learned that we were on our own.”
Marriott turned to private security, as did many other companies. The absence of government support meant that “there was a lot of scrambling for private security,” Callaghan notes.
Berenson, whose company is a government contractor that had personnel at a government-owned shipyard repair facility in the area, typically has had private guard services come in to protect the property in different crises. But, he says, that was difficult in this situation.
Part of the problem was red tape. Since local guard service providers were devastated, businesses needed guards from outside of the area, but they weren’t licensed in the states affected, explains Bill Alford, president of International Lighthouse Group, Charlotte, North Carolina.
And getting through the bureaucratic maze was impossible. “I called DHS, FEMA, everyone,” says Alford. They told him, “We’ll try to get back with you sometime in the middle of next week.”
In the end, he says, one out-of-state guard service provider from New York simply decided to deploy personnel. They did clear it with their attorneys and insurer, says Alford, and they said, “we’re going for it.”
The situation was different for The Steele Foundation, a high-end contract security company with a rapid-response focus, which provided guards and other services to Marriott and other large companies, including Wells Fargo, MCI, British Petroleum, and Best Buy.
Because rapid response in emergencies is their business, they knew how to get the requisite permission. As the company was sending personnel in after the storm, “we had contacted the board of licensing of Louisiana, and they issued a broad declaration of reciprocity” for companies licensed in states with which Louisiana had agreements, says CEO Kenn Kurtz.
In addition to providing thousands of meals and bottles of water for businesses whose personnel needed supplies, Kurtz’s private force helped with search and rescue, evacuating over 2,500 people from the area. They also assisted in asset recovery, such as the relocation of one of the largest art collections in the southeast from a facility that was half-flooded, notes Kurtz.
AlliedBarton says that its officers were primarily asked to provide physical security at facilities. They also helped companies make a record of damages by taking pictures of property, and they helped with retrieval of assets by going in to affected facilities to retrieve important documents and valuables.
No Infrastructure
The complete devastation of the infrastructure in New Orleans made every task difficult. Initially, a major problem at each company’s corporate headquarters was that it was “very difficult just getting the facts, so that they understood the impact on the business and people and … what resources they needed to muster to support their business,” notes McIndoe.
Moreover, notes Johnson Control’s Reisner, “this was the first time where the infrastructure of our people was also totally taken out,” which meant that employees had no homes to go to in many cases, could not communicate with anyone, and could not reach the office.
iJet worked to get critical information to companies through satellite imagery of the locations. Such images would show what was underwater and what hazardous conditions might be encountered if company personnel were sent to the site. But even that was not possible immediately. “We were hindered by cloud cover and the scheduling of satellites,” McIndoe explains.
After assessment came recovery. Though companies did not typically have hot sites to transfer to, they adapted. Johnson Controls dealt with the absence of local systems by setting up emergency operations out of Dallas. It routed computers through servers there to take over for servers no longer working in New Orleans. It also reissued cell phones with working area codes to employees, rerouted e-mails, and basically routed its entire digital infrastructure around the Gulf area, says Reisner.
Even a company as prepared for crises as The Steele Foundation found the absence of any working infrastructure a daunting challenge, however. Like many others, it had to find a way to house employees who came to do the rescue and protection work. Though the company was able to bring in some RVs, “lots of our people slept in tents and makeshift camps for almost five days,” says Kurtz.
The company used watercraft and aircraft to get around and delivered satellite phones to clients to make up for the lack of any communication infrastructure. In the future, says Kurtz, they plan to ramp up supplies of certain types of infrastructure needs, such as generators, to help both themselves and their clients be even more self-sufficient.
In that regard, it’s also worth noting that it matters where companies locate emergency generators. When the waters came, some facilities instantly lost their backup generators, because they were in basements that flooded. The same was true of other critical data and telecommunications systems. Designing with security in mind can minimize that risk.
Ken Brady, CPP, vice president of operations at Crisis Management Associates, refers to a university client of his who was right in the hurricane path. The facility originally had all of its main systems in the basement of an old building.
“This was below sea level. On a good day, the building leaked. On a bad day, it would never keep up. I asked, ‘What if the levees were to break and that basement was flooded? You would immediately lose your power, telecommunications, head end.’ Happily, they decided this was an unacceptable risk.”
At the time, they were building a new gymnasium. The new building would have concrete reinforced walls, with information technology and all other related equipment located in a specially hardened area.
“The building was engineered so that it is 20-feet up on concrete pilings, basically on concrete stilts,” says Brady. “The building can house 1,500 to 2,000 people, so I suggested, why not make this a designated storm shelter in case of a hurricane? This is what they did. They were concerned about the possibility of a hurricane, so invested in the security of the people and the structure.”
No one is questioning the wisdom of that investment today.
Taking Charge
All the resources in the world won’t help if decision-makers don’t take charge of the response and see that those resources are properly deployed. That took too long during Katrina, says McIndoe.
The problem was the way that companies and governments handled the decision-making process between central and local offices. Traditionally, the local crisis management team has autonomy to deal with what’s on the ground, and the corporate team’s mentality is to be a resource provider, says McIndoe. The federal government took the same approach.
In both cases, decision-makers located in the head office waited for people on the ground to tell them what they needed. But local crisis management teams were overwhelmed by the magnitude of what they faced, notes McIndoe.
“Every company now and the feds are going to have to reassess this,” he says, adding that there needs to be some trigger points to signal when top brass knows “we’ve just got to take charge.”
Emergency Operations Centers
A well-designed emergency operations center (EOC) is critical to the success of any disaster response effort. Here are some tips on EOC design from Mike Shea, principal in charge of CODE (critical operations design and engineering) at Ross and Baruzzini, which has designed over 35 emergency management facilities for municipalities and critical infrastructure facilities nationwide.
Assess the site. Do a threat and vulnerability assessment before locating an EOC. Consider what’s adjacent to the site and look both for risks to avoid and services to access—for example, what’s the reliability of utilities serving the site? Ask yourself: How can you make sure that the facility will survive the worst-case scenario?
Build in redundancy. Whether you are talking about fuel supplies, electricity, or communications, you want to build in levels of redundancy. For example, you need at least three days of fuel, if not seven, on site. In addition, the facility should have a hookup for a diesel tank to pull up to the building, which could be used to keep generators running if stored fuel runs out before services return.
The site should have two generators. And as a triple redundancy, you could have provision for pad-mounted generators to be brought in and hooked up to the electrical system in case both generators fail. Similarly, there should be dual mechanical systems to keep building systems operational.
To ensure that communications do not fail, the EOC should have dual communication feeds, including dual Internet fiber connections that are not in the same trench. They should also enter the building in separate locations. Communications systems should come from separate central offices—two separate phone lines—and the electrical system should have redundant lines, preferably underground, that come from separate substations.
The site should also have a backup data center that is not nearby, as well as a mobile communications center unit. And it’s a good idea to include provisions for ham operators to work out of the EOC. “Many times they are the only guys who can get the word out,” says Shea.
Be self-sufficient. Be ready to go it alone. This is the mantra of all disaster-management experts and it applies most of all to the EOC. That means that in addition to the backups for utilities just discussed, the center should have on site adequate domestic water storage, ready-to-eat meals, and sleeping provisions that can accommodate operational staff for several days.
Consider comfort. EOCs have to house many people unaccustomed to working side by side—such as local, state, and federal officials; healthcare personnel; firefighters; and support functions—under highly stressed conditions with no break for days on end. In the past, EOC facilities were not designed with human comfort in mind. They had a bunker mentality and were sometimes literally built underground.
Today, centers are designed to create an environment that uses natural light and other features to reduce stress, helping those who have to work there to endure the demands of the job.
