TERRORIST ATTACK!
by Doug Henderson
One of the most interesting and challenging disaster simulation exercises is the Terrorist Attack scenario. Immediate disaster response efforts have to deal with death and serious injury, with limited availability of normal public emergency services and without key team members who had “perished” during the attack. In this document, Doug Henderson illustrates how one such exercise played out.
ATTACK SCENARIO AND FATALITIES
This scenario contemplated a bomb explosion destroying the home office building. In the scenario we “gave” the company a few minutes notice to evacuate; of course a couple of team members who were working on a rush assignment did not evacuate immediately.
We felt that having no fatalities would be too unrealistic and that the teams should practice business recovery without key individuals. The fatalities — the team members who did not evacuate immediately — were selected by lottery at the beginning of the exercise.
THE ENVIRONMENT
We were careful to accurately describe the general disaster environment during a “Code Red” terrorist attack. I've read about other terrorist attack exercises in which the backup teams were preparing to fly to the hot site immediately after bomb detonations. This is unrealistic. To begin with, if the nation were under this type of attack, all non-military aircraft would almost certainly be grounded. Under Code Red conditions everyone is supposed to take cover, preferable at home with other family members. Attention should focus on life safety concerns; executing business recovery steps during a terrorist attack is unrealistic for most organizations in the immediate vicinity of the attack(s).
The scenario defined the gradual restoration of available resources — staff, telecommunications, travel, alternate site availability, utilities, etc. — at periodic intervals throughout the recovery period.
DISASTER SCENARIO DETAILS
The scenario involved a powerful bomb detonation in a subway station directly beneath the organization's home office building. There were also other bomb detonations in the area that disabled or seriously degraded local travel, communications and normal utility and public services. Alternate site options for non-technology operations were limited. We did place some limits on the attack: There was no radiation, biological, or chemical release.
THE ORGANIZATION'S RESPONSE
Immediate disaster response actions focused on life safety procedures. How do you get medical attention to immobile and unconscious employees? If that's impossible, how do you get them to medical centers? With transportation services disabled, how does everyone get home? When and how do you assemble the recovery teams?
Initial business recovery efforts focused on assembling teams and setting lines of communications with employees, and then with customers. Detailed work function priorities needed to be set. Only critical business activities could be addressed in the first two days after the event. By day seven, most of these activities were operational, although generally with some level of degradation. Even after 30 days, when a new permanent location could be established, shortages of experienced staff would not allow for fully normal operations.
PLANNING THE EXERCISE
To more accurately simulate an actual disaster situation, the CEO wanted the exercise to be a complete surprise. I worked directly with her and her assistant; we were the only people who knew about the upcoming event.
The emergency management and response teams were totally unaware of the disaster scenario. Team members were told to report to the CEO's office, supposedly to review the Business Continuity Plan. Once everyone had assembled, they were directed across the street to a hotel where the exercise would be held. To add a note of desperation, no refreshments were served.
This is an excellent exercise for an experienced group, because the destruction level of the event has almost no boundary. However, I would not recommend this as a first-time exercise for a new management group.
The firm that conducted the exercise was United Educators (Chevy Chase, MD). The business has a strong commitment to business continuity planning, maintaining a comprehensive Business Continuity Plan with effective crisis management protocols. It holds review meetings quarterly and conducts exercises periodically to assure the effectiveness of the plan in an actual emergency.
Douglas M. Henderson, FSA, CDRP, can be reached at Disaster Management, Inc., 1531 SE Sunshine Ave., Port Saint Lucie, FL 34952, (772) 335-9750, Web site www.disastermgt.com, or e-mail
[email protected].