Planning for the unthinkable
The following few paragraphs are excerpted from the 2005 UK Influenza Pandemic Contingency Plan:
“Most experts believe that it is not a question of whether there will be another severe influenza pandemic, but when.” -- The Government’s Chief Medical Officer, 2002
The widespread occurrence – and continued spread – of a highly pathogenic avian (bird) influenza virus (H5N1) in poultry in SE Asia since 2003 has increased concern that this could provide the seedbed for the emergence of a new human influenza virus with pandemic potential.
While international efforts are being directed at preventing such an event, or aborting it early in its tracks, the opportunities to do this are limited and once established, the virus will spread rapidly. The tools to reduce its spread and impact are also limited, and will have to be used to best effect. The UK Government gives high priority to improving our preparedness to manage an influenza pandemic. This document which updates the March 2005 Contingency Plan, sets out the overall UK response. It concentrates on the central Government and health responses, but provides the information and framework for the planning which must take place across all sectors of society.
A pandemic is the worldwide spread of a disease, with outbreaks or epidemics occurring in many countries and in most regions of the world.
Influenza (flu) pandemics have swept the globe from time to time throughout history with devastating effect, far in excess of that resulting from the ‘seasonal’ influenza which (in the UK) occurs most winters.
Three pandemics occurred in the last century – in 1918/19 (‘Spanish’ flu), 1957/58 (‘Asian’ flu) and 1968/69 (‘Hong Kong’ flu). Up to a quarter of the UK population developed illness in each of these pandemics, many thousands of people died and the associated economic and social disruption was huge. The most severe – that of 1918/19 – is estimated to have killed around 250,000 people in the UK and between 20 and 40 million people worldwide, a greater toll than the whole of the First World War.
A pandemic of influenza results when a new influenza virus emerges which is markedly different from recently circulating strains and is able to:
• infect people (rather than, or in addition to, other mammals or birds)
• spread readily from person to person
• cause illness in a high proportion of the people infected, and
• spread widely, because most people will have little or no immunity to the new virus and will be susceptible to infection (they will not previously have been exposed to it or a similar strain of virus, and any previous vaccinations will not have covered the strain).”
Scary stuff isn’t it? This is the kind of thing we read in science fiction novels or history books but it isn’t supposed to be a reality for us now – right? Unfortunately it is, and most of our disaster recovery/business continuity plans are inadequate to deal with this sort of event. Why? Timeframe and affected area. Confused? Let me explain.
Most of our continuity of operations plans (COOP) and disaster recovery plans assume a catastrophic event that destroys infrastructure and personnel in a localized area but with the "event" ending in a relatively short period of time – days, or at the most, a few weeks. Hurricanes, earthquakes, floods, even bombings and other acts of terror are assumed to be relatively short-lived. Then the rebuilding starts. You assess the damage, put your plan into action, and begin anew.
An epidemic or a pandemic is different. The onset is not as dramatic as a natural disaster, the impacts are more widespread, physical damage to infrastructure is not a key characteristic, and they occur over a much longer period of time. Quite different than what our "normal" COOP plans address.
For example, many IT COOP plans have as part of their plans "hot" sites to which operations can be switched. But what if your "hot" site is in an area just as infected as your main site? See the disconnect? Our plans assume physical disaster that prevents work, not the wide-scale loss of personnel to do the work over a long period of time.
It is time to begin to think differently about continuity of operations.
The U.S. Congressional Budget Office issued a report in 2005 in which it considered two possible scenarios for pandemic – mild and severe. The severe scenario projects 90 million cases of infection, 2 million deaths, and a 5% drop in GDP.
Let’s imagine this scenario for a moment. You have large areas of the country possibly under infection with workers sick, dying, or unable or unwilling to come to work because they are at home caring for loved ones who are infected or are afraid to come into contact with another human being. Particularly heavily affected areas might have to be quarantined (this could be your place of business) or a large section of town in which your workforce resides.
This, my friends, is a completely different problem than what is assumed in our typical disaster planning.
So how do we go about tackling this one?
- Your organization needs to understand and accept that this is a real threat that needs to be planned for - which may be harder than you think. People take seriously natural disasters and, after 9/11, the terror threat. Pandemics or epidemics, we want to wish away.
- Obtain more information on what the effects of an epidemic or pandemic are like. Most of us have not witnessed one and do not know what to expect from such a threat. My scenario above barely describes the realm of possibilities.
- Pull people together from all areas of the organization to participate in the planning.
- Start planning now. I can’t tell you myself what the plan will look like or consist of, but I can make some assumptions:
- Remote access of systems from outside your organization by large numbers of users would probably be the norm; i.e., people working from home or even other cities.
- Key personnel will become temporarily or permanently disabled, leaving gaps in knowledge and leadership if appropriate measures are not taken.
- Infrastructure that we currently depend on to provide access may become overtaxed, and therefore unavailable if much of the world is working remotely.
- Collaboration tools become even more important if people cannot physically be together.
- Your key partners in business may not have a plan to deal with the crisis and therefore may become nonexistent or useless.
I could go on, but that’s what your planning effort is supposed to be about – determining what our needs will be during such a prolonged crisis.
My purpose in writing about this is not to be a “Chicken Little” and run about screaming that the sky is falling down – we had enough of that with Y2K; but similar to Y2K, start a thought process and a discussion that will lead to planning, as it did leading up to the year 2000, that ends up with most organizations having crafted plans that will make IT a non-issue in such a crisis. There are a lot of "ifs" concerning avian flu that could make it a non issue in the future (and I really hope that is the case) – however, is your organization willing to gamble on planning only when the crisis appears imminent?