John Pistole

Every security practitioner knows how important it is to be prepared. And, most importantly, to be prepared for ANYTHING. When I visited Kennedy Space Center earlier this month, Mark Borsi, the security director of NASA protective services branch, said something that I think all security practitioners should make his or her mantra: "We plan not only 'A', 'B', and 'C', but well into 'D' and 'E', and we practice those plans."

In the wake of the recent devastating tornadoes, I talked to Barry Scanlon, the former corporate liaison officer with the Federal Emergency Management Agency, and asked him if it's realistically possible for organizations to prepare for disasters of this scale. Here's his answer:

“Unless you have a crystal ball, odds are the events you’re going to be impacted by are events that you haven’t even thought of,” he said. Preparing for such catastrophic events requires an all-hazards approach to business continuity. Businesses can prepare themselves for any level of disaster, but to deal with events of this scale requires extensive planning.

That's why when I read this story in the Huffington Post today, I was floored. In a nutshell, nuclear regulators ruled out the possibility that there could be an earthquake large enough to cause a tsunami that was powerful enough to destroy the reactors:

In the Dec. 19, 2001 document – one double-sized page obtained by The Associated Press under Japan's public records law – Tokyo Electric Power Co. rules out the possibility of a tsunami large enough to knock the plant offline and gives scant details to justify this conclusion, which proved to be wildly optimistic.

Regulators at the Nuclear and Industrial Safety Agency, or NISA, had asked plant operators for assessments of their earthquake and tsunami preparedness. They didn't mind the brevity of TEPCO's response, and apparently made no moves to verify its calculations or ask for supporting documents.

Experts asserted that the biggest earthquake that the nearest fault could produce was 8.6 magnitude. At a 9.0 magnitude, the quake that struck was four times more powerful than that, reported the publication.

The "not possible" approach is bad enough, but the minimal plans that did exist weren't updated for NINE YEARS:
Despite advances in earthquake and tsunami science, the document gathered dust and was never updated.

However, last year Tokyo Electric Power Co. finally did revisit its tsunami preparedness, reports the publication: It was the most cursory of checks. And the conclusion was the same: The facility would remain dry under every scenario the utility envisioned.

Obviously, they were wrong. Very, very wrong. This is a lesson that should never have to be learned the hard way.

A large part of a security practitioner's responsibility is developing an organization's business continuity plans. When disaster strikes, it's critical for an organization to be able to respond and recover as quickly as possible. And, there is a lot of coordination to be done at the local and federal level between both private and public organizations.

Today, I read an interesting article about the nation's disaster recovery plans. Organizations such as the Federal Emergency Management Administration are dedicated to making sure everyone is ready for disaster and that events like the bungled response to Hurricane Katrina never happen again. It's a huge task that requires an immense amount of communication and coordination. And while there's always improvements to be made, I think FEMA and most private and public organizations are far more prepared and aware of the need for robust disaster planning today than they were only a few years ago.

Except, apparently, when it comes to caring for children. Yesterday, the National Commission on Children and Disasters went before Congress with a report that found the nation is unprepared to care for children during a disaster, according to an article in USA Today. Actually, the analysis found that even under normal circumstances, most ambulances and emergency rooms are not prepared to care for severely injured children.

"If you think of a disaster, there may be hundreds of thousands of kids who need medical care, and you'll be putting them in an environment where they don't have the experience or equipment to care for kids," says commission member Michael Anderson of Rainbow Babies & Children's Hospital in Cleveland.

Craig Fugate, President Obama's chief of FEMA (who I am a HUGE fan of, by the way, the guy is really down to earth), says based on his experience as a paramedic he realized this major gap in the nation's response and began meeting with commission in his first week on the job.

"Children are not small adults. You can't scale stuff down and meet the needs of infants and children," said Fugate.

Yeah, we probably shouldn't overlook the future of our nation.