1

Chapter 10

Introduction to Homeland Security

Mitigation, Prevention & Preparedness

Traditional Phases of Disaster Management

2. Preparedness1. Mitigation(Pre-event)

4. Recovery 3. Response(Post-event)

Mitigation

• Mitigation: a sustained action to reduce or eliminate risk to people & property from hazards & their effects

• Mitigation activities address either or both• Mitigation activities address either or both components of risk• Probability (likelihood)• Consequence

• Mitigating either one reduces the threat

2

Mitigation:Natural vs. Man-made Disasters

• Natural Disasters• Ability to limit probability of a hazard largely

based on the type of disaster• Tornado or hurricane vs. flood or wildfireTornado or hurricane vs. flood or wildfire

• Mitigation efforts tend to focus on consequence management

• Man-made Disasters• Much greater range of opportunities to

minimize both probability & consequence

Preparedness

• Preparedness: a state of readiness to respond to a disaster, crisis, or any other type of emergency situation

• Preparedness activities can be categorized as the human component of hazard management• Most common:

• Training• Public Education

• They do little to prevent a disaster, but are very effective at ensuring that people know what to do once one has happened

National Response Plan (NRP)

• Provided the national framework for disaster management• Replaced the Federal Response Plan in DEC

20042004• Introduced new terminology to the disaster

management sequence, but did not necessarily define them

• NRP replaced by the National Response Framework (NRF) in 2008

3

Phases of Disaster Management –According to the NRP

2. Preparedness1. Prevention(Pre-event)

5. Mitigation

4. Recovery(Post-event)

3. Response

NRP - Significance of Changes

• Moving Mitigation to the end of the cycle implies that it is a post-event activity• Alters an already widely understood &

accepted conceptaccepted concept• May result in unnecessary confusion during

a crisis

Significance of Changes (cont.)

• Introduces the new term & concept, prevention• Defined as “actions taken to avoid an

incident or to intervene to stop an incidentincident or to intervene to stop an incident from occurring, which involves actions taken to protect lives & property.”

• Based on the definition, is the NRP focused more on terrorism vice the traditional all-hazards approach?

4

NRF vs. NRP: Significance of Changes

1) Document title more accurately reflects its true nature• Provides guidelines, rules of engagement &

an organizational framework for everyonean organizational framework for everyone involved in federal disaster response, not just specific steps like those found in Emergency Operations Plans (EOPs)

NRF vs. NRP: Significance of Changes (cont.)

2) NRF does attempt to redefine the phases of emergency management

• Makes no direct reference to the emergency management cyclemanagement cycle

• Refers to terms only• Prevention• Mitigation

• More in line with an all-hazards approach than the NRP terrorism-focused approach

NRF vs. NRP: Significance of Changes (cont.)

3) Adjustments made to general terms that better accommodate the involvement & partnership of nonfederal participants

• Emergency support functions (ESFs) better defined

5

NRF vs. NRP: Significance of Changes (cont.)

4) Commits the federal govt. to the development of specific emergency response plans based on the 15 incident scenarios identified by the Homelandscenarios identified by the Homeland Security Council

• This last change is the most controversial• Some feel that flexibility is sacrificed & problems

may arise when real situations do not fit the expected pattern

• Also seen by some as departing from the all-hazards approach

FEMA Mitigation Planning Process

1. Identify & organize resources2. Conduct a risk or threat assessment &

estimate losses3 Id tif iti ti th t ill3. Identify mitigation measures that will:

• Reduce the effects of the hazards &;• Create a strategy to deal with the mitigation

measures in priority order4. Implement the measures, evaluate the results,

& keep the plan up-to-date

Risk

• Three questions to ask when considering risk:1) What can happen?2) How likely is it? (probability)2) How likely is it? (probability)3) What are the consequences?

• Risk = the probability of occurrence x the consequences

6

Risk (cont.)• Probability most difficult to determine

• Often based more on expert judgment than concrete evidence

• Can use historical data to calculate b bilitprobability

Risk (cont.)• Example of probability estimates

• Certain: >99% chance of occurring in a given year (One or more occurrence a year)

• Likely: 50%-99% chance of occurring in a given year (One occurrence every 1 to 2 years)y ( y y )

• Possible: 5%-49% chance of occurring in a given year (One occurrence every 2 to 20 years)

• Unlikely: 2-5% chance of occurring in a given year (One occurrence every 20 to 50 years)

• Rare: 1%-2% chance of occurring in a given year (One occurrence every 50 to 100 years)

• Extremely Rare: <1% chance of occurring in a given year (One occurrence every 100 or more years)

Risk (cont.)• Consequences: a measure of expected

disaster impacts• Tangible – loss of life, property• Intangible – psychological impact, morale

Diffi l if• Difficult to quantify

• Once factors are determined, it is possible to compare risks• Risk matrix

7

Example Risk Matrix0-5 = Low Risk Severity of the potential damage or injury

6-10= Moderate 1 Insignificant damage to property & equipment, minor injury

2 Non-reportable injury, minor loss of process, or slight damage to propert

3Reportable injury, moderate loss of process, or limited damage to propert

4Major injury, single fatality,Critical loss of process/ damage to

5 Multiple fatalities,Catastrophicloss of business

11-15 = High Risk16-25 = ExtremelyHigh Risk

property property damage to property

Likelihood of hazard

happening

5 - Almost Certain

5 10 15 20 25

4 - WillProbably Occur

4 8 12 16 20

3 - Possibly Occur

3 6 9 12 15

2 - Remote Possibility

2 2 6 8 10

1 - ExtremelyUnlikely

1 2 3 4 5

Consequences Measure Tangible Losses Intangible Losses

Deaths # of people Loss of economically active individuals

Social & psych. effects on remaining community

Injuries # & injury severity Med. treatment needs, temp. loss of economic activity by productive individuals

Social & psych. Pain & recovery

Physical damage Inventory of damaged elements by # & damage level

Replacement & repair cost Cultural losses

Emergency operations

Value of manpower, person-days employed, equip. &

Stress & overwork in relief participants

resources expended to relief mobilization cost, investment in preparedness capability

Disruption to econ. # of working days lost, volume of prod. lost

Value of lost production opportunities, & in competitiveness & reputation

Social disruption Number of working days lost

Temp. housing, relief, & economic production

Psych., social contacts,cohesion, comm. morale

Environmental impact

Scale & severity Cleanup costs, repair costs Consequences of poorer environment, health risks, risk of future disaster

Risk (cont.)• Traffic accident

• Probability?• Consequence?

• Large asteroid strike on earth• Probability?• Consequence?

8

Risk (cont.)

• Once risk is identified, how can it be mitigated?

• Risk managers try to reduce either or both:both:• Probability• Consequence

Mitigation & Preparedness

• Concepts of mitigation & preparedness have changed post 9/11• Terrorism has become the threat focus

Has this changed how we view the• Has this changed how we view the concepts of preparedness & mitigation?

Mitigation & Terrorism

• When applying mitigation, attempts are made to minimize both the probability & consequence components of risk

• With many risks, however, only consequences can be reduced

• With terrorism, however, there is a unique opportunity to make reductions to both the probability & the consequence of an attack

9

Mitigation & Terrorism (cont.)• Minimizing the probability of a terrorist attack is

very possible• Often done through successful intelligence about:

• Terrorist activities• Locations• Networks• Communication strategies

• But, usually requires very large expenditures to:• Build & manage systems• Establish international partnerships• Build networks to identify & detain terrorists

• Terrorism consequences can also be mitigated, but the wide range of possible consequences makes it difficult & expensive

Federal Insurance & Mitigation Administration (FIMA)

• Responsible for a majority of US government hazard mitigation activities• Performs several organizational activities that

serve to promote protection, prevention, & partnerships at the federal, state, local, & individual levelsindividual levels

• Overall mission is to protect lives & prevent the loss of property from natural & other hazards

• Employs the all hazards approach through a comprehensive, risk-based EM program

FIMA Divisions

• Risk Analysis Division• Provides technical expertise & analytical capability

in identifying & quantifying risks, hazards, & vulnerabilities

• Risk Reduction Division• Risk Reduction Division• Reduces risks & vulnerabilities through proactive

intervention measures, such as land use planning, code design, & dissemination of best practices

• Risk Insurance Division• Primary responsibility is to run the National Flood

Insurance Program (NFIP)

10

Risk Analysis Division –National Flood Map Modernization Program

(NFMM)• Multiyear program to improve existing

flood maps in the US & to create maps for which no maps exist• Takes advantage of new technologies &

standardsstandards• Improved flood maps provide more

reliable info on flood risks & help stakeholders make better decisions regarding flood risks & land use decisions• Use of maps can reduce total costs of flood

damages in the long run

Risk Analysis Division (cont.) -National Dam Safety Program

• Provides funding for states to be used in dam safety-related activities• Dam safety training• Increase the frequency of dam safety

inspections• Create & test emergency response plans• Promote dam safety awareness

Risk Analysis Division (cont.) –Mitigation Planning Program

• Creates:• Multi-hazard mitigation planning manuals• “How-to” guidelines• Best-practice documentsp

• Works closely with the following programs run by FEMA’s Risk Reduction Division:• (Post-disaster) Hazard Mitigation Grant

program • Pre-disaster Mitigation Program

11

Risk Reduction Division –National Earthquake Hazards Reduction Program (NEHRP)

• Established by Earthquake Hazards Reduction Act of 1977 to:• “reduce the risks of life & property from future

th k i th US”earthquakes in the US”• Four agencies involved:

1) FEMA2) National Institute if Standards &

Technologies (NIST)3) National Science Foundation (NSF)4) US Geological Survey (USGS)

Risk Reduction Division (cont.)–NEHRP (cont.)

1) FEMA• Translates research results into technical papers• Supports state & local governments by providing

multiple-hazard loss estimation capability for use inmultiple hazard loss estimation capability for use in planning

• Prepares technical documents aimed at improving the seismic safety of new & existing buildings

• Works with national standards organizations to develop seismic standards for new & existing lifelines

• Prepares & disseminates info about building codes & practices

Risk Reduction Division (cont.)–NEHRP (cont.)

2) National Institutes of Standards & Technology (NIST)

• Promotes better building practices among architects & engineersg

• Works with national standards organizations to develop improved seismic standards for new & existing lifelines

• Chairs & provides the secretariat for the Interagency Committee on Seismic Safety in Construction (ICSSC)

• Recommends practices & policies to reduce earthquake hazards in federally owned, leased, assisted, & regulated facilities

12

Risk Reduction Division –NEHRP (cont.)

3) National Science Foundation (NSF)• Supports research on tectonic plates• Funds engineering research on

geotechnical structural & architecturalgeotechnical, structural, & architectural systems

• Supports research on the social & economic aspects of earthquake hazard mitigation

• Supports the education of new scientists & engineers in the field

Risk Reduction Division –NEHRP (cont.)

4) US Geological Survey (USGS)• Provides national & regional seismic

hazard & risk maps• Conducts engineering seismology studies• Conducts engineering seismology studies

for the ground-shaking phenomenon• Develops methods & standardized

procedures for forecasting quakes• Supports an external cooperative grants

research program• Operates national seismograph networks

Risk Reduction Division –NEHRP (cont.)

• FEMA was lead program manager until 2003• Now managed by NIST

• Essential program due to the susceptibility p g p yof the entire US to earthquake disasters• There are multiple active faults throughout

the US• San Andreas – CA• New Madrid – IL, MO, AR, KY, TN

• Many of the consequences of an earthquake can be mitigated

13

US Earthquake Hazard Zones

FEMA Mitigation Grant Programs

• FEMA currently has five mitigation grant programs1) Hazards Mitigations Grant Program2) Pre-Disaster Mitigation Grant Program3) Flood Litigation Assistance Grant Program4) S R titi L G t P4) Severe Repetitive Loss Grant Program

(SRL)5) Repetitive Flood Claims Grant Program

(RFC)• All are administered by the Risk

Reduction Division of the Mitigation Directorate

Risk Reduction Division –Hazard Mitigation Grant Program

• Provides grants to state & local govts to implement long-term hazard mitigation measures after a major disaster declaration

• Purpose: • Reduce the loss of life & property due to

natural disasters, &;• Enable mitigation measures to be

implemented during the immediate recovery from a disaster

14

Risk Reduction Division –Hazard Mitigation Grant Program (cont.)

• Only available in states following a presidential disaster declaration

• Eligible applicants are:• State & local governmentsState & local governments • Indian tribes or other tribal organizations • Certain private or non-profit organizations

• Projects must meet two criteria:1) Must provide a long-term solution to a problem2) Potential savings must be more than the cost of

implementing the project

Risk Reduction Division –Pre-Disaster Mitigation Grant Program

• Assists state & local governments in implementing cost-effective hazard mitigation activities that complement a comprehensive mitigation program

• Criteria:• Applicants must be participants in the National

Flood Insurance Program (NFIP) (if applicable)• Must have an approved local mitigation plan in order

to receive funds• Thus, development of state & local multi-hazard

mitigation plans is key to maintaining eligibility for future PDM funding

Risk Reduction Division –Flood Mitigation Assistance (FMA) Program

• Provides funding to assist states/communities in implementing measures to reduce/eliminatethe long-term risk of flood damage to:• Buildings• Manufactured homes• Other structures insurable under the NFIP• Other structures insurable under the NFIP

• Types of grants available under FMA: • Planning

• Used to prepare flood mitigation plans• Project

• Implement measure to reduce flood losses• Technical Assistance

• Used by the states to administer their programs• Must participate in NFIP to be eligible

15

Risk Reduction Division –Severe Repetitive Loss Program

• A proactive mitigation initiative of the NFIP to reduce or eliminate flood-related damages & insurance claims for the approx. 83,000 residential properties that qualify as structures w/severe repetitive flood damage potential

• Reduces the cost of NFIP claims by funding• Reduces the cost of NFIP claims by funding mitigation projects that strengthen structures against flood damage, such as:• Flood proofing (historical structures only)• Relocation• Elevation• Acquisition• Mitigation reconstruction (demolition/rebuild)• Minor physical localized flood control projects

Risk Reduction Division –Repetitive Flood Claims Program

• Similar to Severe Repetitive Loss Program, but qualifying standards are lower

• Any state or community which had at least one NFIP Claim can apply forleast one NFIP Claim can apply for funding to reduce the vulnerabilities of properties against flooding

• Funds can only be spent to improvestructures located in areas that are ineligible for the Flood Mitigation Assistance (FMA) Program due to cost share or capacity to manage the activities

Risk Insurance Division –National Flood Insurance Program (NFIP)

• Established by Congress with the passage of the National Flood Insurance Act of 1968

• Enables property owners to buy insurance as a protection against floods i h f t t & itin exchange for state & community floodplain management regulations that reduce future flood damages

• Designed to provide an alternative to disaster assistance to reduce the escalating costs of repairing damage to building & their contents caused by flood

16

Risk Insurance Division –NFIP (cont.)

• Flood damage reduced nearly $1 billion per year• Buildings constructed in compliance with

NFIP standards suffer approximately 80% less damage

Every $3 paid in flood insurance claims• Every $3 paid in flood insurance claims saves $1 in disaster assistance payments

Prevention Actions & Programs

• Prevention: actions taken to avoid an incident or intervening to stop an incident from occurring, in an effort to save lives & property

• National Response Framework (NRF)• National Response Framework (NRF) may be implemented for threats or potential incidents of national significance to prevent or intervene in order to lessen the impact of an incident

Prevention Actions & Programs (cont.)

• Prevention activities may include: • Heightened inspections• Improved surveillance & security operations• Public health & agricultural surveillance &

t titesting• Immunizations, isolation, or quarantine• Specific law enforcement operations aimed at

deterring, preempting, interdicting, or disrupting illegal activity & apprehending potential perpetrators & bringing them to justice

17

Prevention Actions & Programs (cont.)

• Most prevention activities are related to terrorism• As defined w/in the NRF, any activity that

intends to prevent terrorist attacks can be qualified as a prevention measure

• All federal law enforcement activities are coordinated by the attorney general, generally acting through the FBI

Prevention Actions & Programs (cont.)

• Initial prevention efforts may include:• Collect, analyze, & apply intel & other info• Conduct investigations to determine full nature &

source of threat• Implement countermeasures such as surveillance &

counterintelligencecounterintelligence• Conduct security ops, including vulnerability

assessments, site security, & infrastructure protection• Conduct tactical ops to prevent, interdict, preempt, or

disrupt illegal activity• Conduct attribution investigations, including the

assessment of the potential for future related incidents• Conduct activities to prevent terrorists, terrorist

weapons from entering/moving within the US

Preparedness Actions & Programs

• Preparedness:• A state of readiness to respond to a disaster,

crisis, or any other type of emergency situation

• It includes those activities, programs, & systems that exist before an emergency that are used to support & enhance response to an emergency or disaster

• Evacuation drills• First responder training

18

Preparedness Actions & Programs (cont.)

• Important part of the EM cycle• Provides for the readiness & testing of all

actions & plans prior to actual application in a real event or disasterreal event or disaster

• Close connection between mitigation & preparedness• Difference can sometimes be unclear

• Preparedness is the planning for best response

• Mitigation is all efforts to prevent or lessen the need for response

Preparedness Actions & Programs (cont.)

• Post 9/11 there has been an increased focus on terrorism preparedness

• Risk of terrorists obtaining & using bi l i l h i l & di l i l tbiological, chemical, & radiological agents has forced the govt. to focus more on this risk

• Govt. has had to develop adequate response capability, capacity, & expertise

Bio/Chem Attack/Accident Preparedness

• Poses a distinct challenge due to:• Unique consequences • Relatively limited experience of EM professionals in

dealing with them• This challenge is being addressed by local,

state, federal, private, & non-profit agencies • The majority of DHS preparedness funding

targets these WMD hazards

19

Bio/Chem Attack/Accident Preparedness (cont.)

• These agents present public health threats that are not normally seen in either day-to-day or even major incidents of natural or unintentional man-made nature

• Methods by which citizens & response officials• Methods by which citizens & response officials can prepare for these attacks have only begun to emerge recently

• Chemical incidents do occur with regularity, but deliberate attacks are rare

• Chem/Bio weapons have the potential to overwhelm the capabilities of the public health system

Bio/Chem Attack Response Challenges

• The existence of a chem/bio attack may be hard to verify due to delayed consequences or symptoms

• May involve multiple jurisdictions• Difficult to organize a coordinated response

• May be time consuming to ID & isolate the type & source of the agent present on site

• Incident may be a specific target/group, or be designed to impact a larger geographical area• Both may result in large numbers of morbidity or

mortality

Bio/Chem Attack Response Challenges (cont.)

• Attack results may overwhelm capabilities of the local/regional health care system

• Efforts to ID agents involved may overwhelm capacity of available labscapacity of available labs

• Medical system resources may be consumed by those who are affected & those that think they might be infected

• EM officials might be in the position of having to quickly decide who lives & who dies

20

Bio/Chem Attack Response Challenges (cont.)

• Quarantining the affected area may become necessary

• Medical personnel may have to triage incoming victims due to large numbers & resourcevictims due to large numbers & resource constraints

• Decontamination systems, equipment, & personnel may be required at multiple locations

• Medical system may also have to deal with the mental impacts of an attack• Mass paranoia

Medical & Health Incident Management System (MaHIM)

• Designed to help communities develop their own medical mass-casualty incident management capacity

• System does not focus only on developing• System does not focus only on developing local capabilities• Proposes inter-jurisdictional framework to

deal with incidents that spread beyond local jurisdictions

MaHIM (cont.)

• Goal: To define a single system encompassing the medical & public health functions & processes required for adequate management of a mass

lt i id tcasualty incident• An all-hazards approach used in the

system’s design, with a special consideration given to bio-terrorism

21

MaHIM (cont.)• The MaHIM system defines the goal of

medical consequence management in a mass casualty incident as:• Maximally limiting death/injury in the

population exposed to a major hazard, & to return the community to normalcy as soon asreturn the community to normalcy as soon as possible

• The 3 medical objectives to achieve this goal are:1) Reduce hazard exposure2) Increase hazard resistance3) Promote/achieve healing from hazard effects

Nuclear/Radiological Preparedness -Nuclear Regulatory Commission (NRC)

• Primary federal agency in charge of regulating US commercial radiological operations

• Mission:To regulate the nation’s civilian use of• To regulate the nation s civilian use of byproduct, source & special nuclear to ensure adequate protection of public health & safety;

• Promote the common defense & security, &;

• To protect the environment

Nuclear/Radiological Preparedness (cont.) –NRC (cont.)

• The NRC's regulatory mission covers three main areas:

1) Reactors• Power generation• Research & testing

2) Materials)• Medical• Industrial• Academic• Fuel production

3) Waste• Transportation• Storage• Disposal• Decommissioning of nuclear facilities

22

NRC’s National Emergency Preparedness (EP) Program

• Ensures plant operators are capable of implementing adequate measures to protect public health & safety in the event of a radiological emergency

• As a condition of their license, operators must develop & maintain EP plans that meet NRC EPdevelop & maintain EP plans that meet NRC EP requirements• Plans must be exercised every 2 years• Must include govt. participation

• Exercises are performed to:• Maintain skills of emergency responders• ID & correct weaknesses

• Additional drills conducted between exercises

Terrorism Preparedness & Mitigation - Community Issues

• The terrorism threat knows no geographic, social or economic boundaries• Every citizen/community is potentially at risk y y p y

• DHS focuses on federal & state efforts to prepare for & combat terrorism• However, local communities are struggling to

address the terrorism risk• Subsequently, several initiatives have been

launched to address this threat

Corporation for National & Community Service (CNCS)

• Independent agency under the White House that helps prepare the nation for disasters through volunteer programs• Provides opportunities for all Americans toProvides opportunities for all Americans to

engage in community service• To help meet community needs, members &

volunteers serve with national & community:• Non-profit organizations• Faith-based groups• Schools• Local agencies

23

CNCS (cont.)

• Many CNCS activities are related to homeland security & serve to increase national & community preparedness for all hazards

• Consists of:• Senior Corps• AmeriCorps• Learn & Serve America

Citizen Corps• Created in 2002 to “help coordinate volunteer

activities that will make our communities safer, stronger, & better prepared to respond to any emergency situation”

• Coordinated nationally by FEMACoordinated nationally by FEMA• Programs include:

• Community Emergency Response Teams (CERT)• Medical Reserve Corps (MRC)• Neighborhood Watch Program• Volunteers in Police Service (VIPS)• Fire Corps

Citizen Corps – CERT

• Trains people to be better prepared to respond to emergency situations in their communities

• When emergencies happen, CERT members can:• Give critical support to first responders• Provide immediate assistance to victims• Organize spontaneous volunteers at a

disaster site

24

Citizen Corps –CERT (cont.)

• CERT classes taught in the community by a trained team of first responders

• Classes include• Disaster preparedness• Disaster fire suppression• Basic disaster medical operations• Light search & rescue operations

Citizen Corps –Medical Reserve Corps

(MRC) Program• Addresses the communities’ public health

needs, both ongoing & during large-scale emergency situations, by coordinates the skills of practicing & retired:• Physicians• Nurses• Other health professionals• Other citizens interested in health issues

Other Citizen Corps Programs• Neighborhood Watch Program

(NWP)• Volunteers in Police Service

(VIPS)• Fire Corps

• Mission: To help career, volunteer, & combination fire departments supplement existing personnel resources by recruiting citizen advocates who support the department in non-operational roles

25

Community Preparedness –Non-Govt. Programs

• The American Red Cross• Has always been one of the most

important partners of federal, state, & local govts in disaster preparation & relief operationspreparation & relief operations

• Chapters have begun to develop homeland security programs to provide training for community volunteers

Private Sector Involvement in Mitigation & Preparedness

• 9/11 exposed the importance of private-sector involvement in crisis, emergency, & disaster management

• Most of the private-sector responses have been based off of experience with natural & man-made disasters• Terrorism is a different threat, but the same

classical emergency preparedness concepts apply

Private Sector Involvement in Mitigation & Preparedness Activities

• Business Impact Analyses (BIAs)• Management level analysis of the impacts, effects, &

losses as a result of a disaster• Used to make decisions concerning business

continuity management strategiescontinuity management strategies• Crisis Communications Planning

• Rumor control• Public relations

• IT & Systems Infrastructure Redundancy Planning• Reliable systems infrastructure (backup databases,

software, hardware)

26

Private Sector Involvement in Mitigation & Preparedness Activities (cont.)

• Geographic Location & Back-Up Sites• Headquarters• Offices• Distribution of executives in those buildings

G l i t i i i l (b th h & h i l)• Goal is to minimize losses (both human & physical) • Transportation Planning

• One of the most sensitive infrastructures to emergency & disaster situations

• Overloaded transportation infrastructure usually a reason for micro-disasters in the midst of bigger ones

• Realistic planning a must

Private Sector Involvement in Mitigation & Preparedness Activities (cont.)

• Crisis Leadership• During crisis situations, people need someone to tell

them what is going on & what is being done about it• Strong leadership motivates them to overcome the

i icrisis • Insurance

• Companies must have adequate insurance• In order to do so, companies must conduct realistic risk

assessments

Sarbanes-Oxley Act of 2002

• Created to protect investors by improving the accuracy & reliability of corporate disclosures• Direct response to financial fraud in the Enron &

WorldCom cases• Was created to address issues beyond fraud• Is now a driving force behind corporate

Business Continuity Planning (BCP)• Section 404 of the act implies BCP must be

taken for compliance

27

Best Practices Case Study: Cantor Fitzgerald/eSpeed

• Lost more than 700 employees on 9/11, including ~half of the eSpeed technology staff

• Lost its corporate headquarters & computer center

• eSpeed back up & running by 8 AM on 9/13• Most of the top executives were out of the building at

the time of the attack• Company had dual architecture in place

• All machines, connections, & functionality had been replicated at two other sites

• Company survived as a viable business

TOPOFF 2 Exercise• Conducted 12 MAY 2003• Most expensive, comprehensive

preparedness exercise ever undertaken • $16 million price tag• $16 million price tag• Included more than 8,000

participants from 19 federal agencies • Designed to test & improve

response capacity of “top officials” in the event of a WMD attack

TOPOFF 2 Exercise (cont.)• Goals:

• Improve the nation's capacity to manage extreme events

• Create broader frameworks for the operation of expert crisis & consequence p p qmanagement systems

• Validate authorities, strategies, plans, policies, procedures, & protocols

• Build a sustainable, systematic national exercise program to support the national strategy for homeland security

28

TOPOFF 2 Exercise (cont.)• Scenario:

• Dirty bomb detonated in Seattle• 30 people “contaminated”

• 24 hrs later, evidence of a biological attack (pneumonic plague) in Chicago & the surrounding area• Over 300 “victims”

• Car bomb & hostage situation in Tacoma, WA

TOPOFF 2 Exercise (cont.)• Problems encountered:

• Victims had to be decontaminated before being treated

• Scene control was difficult• Emergency workers went in before

knowing that the area was contaminated• Wide variety of symptoms made victim

diagnoses difficult• Transportations systems had to be

rerouted to avoid contaminated areas