These are not the worst disasters you will see

1. 9/11. Katrina. Virginia Tech. The worst disaster you will see is the one that happens to you or your business These are not the worst disasters you will see

2. Every Crisis is a Human Crisis The success of your organization relies on the preparedness of people

3. Disaster Exposure Almost 2/3 of companies that suffered a disaster experienced lost business

4. Five Most Common Failures

5. Action Items Predict. Plan. Perform. • Identify & Involve • Critical Suppliers • Critical Functions • Critical Employees • What If Exercises • Establish How To: • Monitor • Communicate

6. Lessons Learned Virginia Tech was the definitive episode of Violence in the Workplace

7. Timing

8. Northern Illinois University

9. “Predictable Surprises” Almost every disaster, incident of school/workplace violence and act of terrorism was preceded by warning signals.

10. Crisis Management: First Response • Pastoral setting: • Physically-intact campus • Traumatized community • Media circus • 324 Media outlets • 140 Satellite trucks • $4 million by major network in first week

11. Crisis Communications Response • Transparency • Framing messages • Controlled accessibility • Established call center to broker access and provide information • Signage on campus buildings when classes resumed • Metrics • Timeline

12. Crisis Management: The Media

13. Timeline • Initial shootings in West Amber-Johnston Hall • Lovers’ triangle • Absence of students to interview • Immediate arrest of ‘suspect’ • Boyfriend left “in a hurry” • Guns found in truck • Norris Hall response • Nine minutes from entry to end of shootings

14. The First 24 Hours WRONG

15. Why We Discount Risk • Time alters our perception of risk • It can’t happen here. • It can’t happen to me. • It won’t be so bad. • I’m smarter and better prepared.

16. Disaster Denial “There cannot be a crisis next week. My schedule is already full.” Henry Kissinger

17. Why Continuity Planning? • Public Law 110-53, Title IX • Business environment at greater risk • Natural disasters • Pandemic threat • Terrorism • Economy at risk • Governance requirements • Disclosure issues • Regulatory guidelines • Sarbanes-Oxley • Looming litigation

18. Statistics of Failure 83% 20% 30% OF BUSINESSES WILL LOSE TOOF THEIR SHAREHOLDER VALUE IN 5 YEARS AS A RESULT OF A DISASTER OR CRISIS. OF CONTINUITY PLANS HAVE NEVER BEEN TESTED. DISASTERS OCCUR ANNUALLY IN THE U.S. OF BUSINESSES STRUCK BY A DISASTER NEVER REOPEN, AND OF THOSE THAT REOPEN CLOSE IN TWO YEARS. 80% 70,000+ 40% 25%

19. Opportunity Timeline Prepare and Plan Monitor and Take Action Manage and Mitigate Return to ‘Normal’ Pre IMMINENT During Recovery

20. Disaster Denial

21. Why Now? • Business environment is less forgiving • Risk management is usually internal, but external risks have not been addressed • Systemic risks have not been a focus – how to survive a major industry-wide event

22. Vulnerabilities Earthquakes Extreme Heat Fires Floods Global Warming Hazardous Materials Hurricanes Landslides Multi-Hazard Nuclear Pandemic Tornadoes Terrorism Power Outages Thunderstorms WildfiresWinter Storms Workplace Violence Dam Safety Earthquakes Tsunamis Fires Extreme Heat Floods Global Warming Hazardous MaterialsHurricanesNuclear Pandemic Terrorism Power Outages Landslides Wildfires Thunderstorms Tsunamis Volcanoes Winter Storms Earthquakes Fires Global Warming Landslides Tornadoes Floods Hurricanes Pandemic Power Outages Thunderstorms Terrorism Nuclear

23. Vulnerability Analysis Impact Awareness & Contingency Planning Corporate Governance & Preaction Plan Normal operations Certainty

24. The Disaster Environment DISASTER Stake holders Work & School Your Company/ Clients Customers Family & Friends Critical Suppliers Employees DISASTER

25. In/Out/Across Analysis

26. Liabilities

27. It’s More Than an IT Issue • Systems do not protect people • Servers cannot initiate action • Networks will not be held accountable • No people → No recovery Every Crisis is a Human Crisis. Every Crisis is a Human Crisis.

28. Rule 1, 2, 3 Disasters result in high absenteeism: Train 3 employees for each critical task

29. Crisis Communications

30. What Constitutes a Pandemic?

31. Modes of Transmission • Contact Transmission Direct Contact Indirect Contact • Droplet Transmission • Airborne Transmission P 1 P 2 P 1 P 3 P 1 P 2 P 2 P 1

32. Odyssey of SARS Transmission 3 hour Flight; Hong Kong to Beijing, March 15, 2003 18 Cases 4 Deaths Index Case Crew Member Probable Case

33. The 9/11 Commission “Preparedness is not a luxury; it is a cost of doing business.”

34. Update: What’s Changed • Public Law 110-53, Title IX • Situation in Mexico • Bio-terrorism • Workplace Violence

35. Public Law 110-53, Title IX In the “Implementing the Recommendations of the 9/11 Commission Act of 2007” (the 9/11 Act), Congress mandated the Department of Homeland Security (DHS) to provide “voluntary”preparedness certification and “develop guidance or recommendations and identify best practices to assist or foster action by the private sector” across a wide range of business continuity practices.

36. Mexico: Will the Violence Spill Over to the U.S? U.S. security no match for Mexican drug cartels The Obama administration announced this week it is sending hundreds of federal agents and crime-fighting equipment to the Mexican border to try to make sure violence from Mexican drug cartels doesn't spill over into the U.S. –CNN, March 27,2009

37. Bio-Terrorism Bio-terrorism – Al Qaida and the Plague The story began with a Jan. 6 report in the Algerian newspaper Echorouk that a number of terrorists had died of the plague in one of al-Qaida training camps in Tizi Ouzou. Another Algerian newspaper En-Nahar, affirmed that 50 terrorists have been diagnosed with the plague, 40 of whom have already died.

38. Workplace Violence: On the Rise? • Businesses are bracing for more crimes committed by both external and internal perpetrators in a rough economy: • The worry is that poor market conditions will result in more burglaries, and • Company layoffs could increase cases of embezzlement, theft and workplace violence by disgruntled workers • Domestic violence is moving to the workplace

39. What Constitutes Workplace Violence? Any physical assault, threatening behavior, or verbal abuse occurring the work setting. It includes, but is not limited to: • Psychological • Intimidating presence • Harassment (being followed, sworn at, or shouted at) • Obscene phone calls • Threats • Physical • Beatings • Rapes • Shootings • Stabbings • Suicides

40. Current Environment • 70% of workplaces have no formal workplace violence program, despite findings that there are thousands threats of violence every workday • 43% of those threatened and 24% of those attacked at work do not report the incident • Workplace violence myth: most incidents come out of the blue. • “These incidents don’t just happen spontaneously. People work through a process—there is a pathway that people will pursue toward ultimately committing violence.“ Source: JohnLane, VP of Crisis and Security Consulting Control Risks ASIS 54th Seminar, 2008

41. OSHA & STATE STATUTES • A collection of negligence theories, including negligent hiring (the failure to properly screen job applicants, particularly for sensitive positions involving a high degree of interaction with the public); negligent supervision (the failure to supervise employees and to discipline violators of anti-violence rules) • Negligent retention (the failure to terminate employees who have engaged in behavior in violation of company policies). • Premises liability (the duty of a property owner to take responsible steps to guard against reasonably foreseeable violence) • Respondeat superior (an employer’s indirect liability for the wrongful acts of an employee committed within the course and scope of employment) • Sexual and other forms of harassment prohibited under discrimination laws (when threats or violence are motivated by a victim’s protected status); and • Employer owes a ‘‘general duty’’ to protect employees against ‘‘recognized hazards’’ that are likely to cause serious injury or death. Workplace violence has been identified as one of those hazards, and both federal and state OSHA agencies have issued citations to employers under the Act’s general duty clause for failure to protect employees against workplace violence • Employer’s obligation to maintain a safe place to work also arises from the legal principles that exist in most states under common law. Legal principles most commonly discussed in litigated cases involving workplace violence include:

42. Company Responsibility OSHA • section 5(a)(1) of the OSH Act, often referred to as the General Duty Clause, requires employers to "furnish to each of their employees employment and a place of employment which are free from recognized hazards that are causing or are likely to cause death or serious physical harm to his employees". • section 5(a)(2) requires employers to "comply with occupational safety and health standards promulgated under this Act".

43. Background Statistics • 1970’s-present: incidents of workplace violence have tripled • Major contributors include: • Aggressive employees • Domestic violence brought into the workplace • Employers not taking recurring threats seriously • Ethnic differences among workers • Negligent hiring, supervision, or retention of aggressive employees • Substance abuse • Layoffs and company downsizing L • Poor handling of employee termination • Estimated cost to business $120 billion

44. Actions • Recognize behavior • What to do/who to call • How to deal with potentially violent individuals • Individual responsibility in following procedures; • Get to cover • Flee • Defend yourself • Utilize available communications • Procedures training • Front desk, reception, panic alarm training • Practice all protocols/procedures

45. During the event • People need to know how to protect themselves and others • The drive to connect and reconnect is great; plan on families and others coming to the scene • Prepare for communication among crisis responders, develop plan for working with media, etc

46. After the critical event is resolved • A catastrophic event is often the first of many crises that will be faced • Recovery is a non-linear process that leads to a new normal • Individuals will need to reconcile to a new worldview that accepts the awareness of vulnerability • Connection, communication, and perceived intentions of others become acutely significant

47. “Predictable Surprises” Almost every disaster, incident of school/workplace violence and act of terrorism was preceded by warning signals.

48. Disaster Ready People for a Disaster Ready America What Me Worry? • I don’t know what to do • It will take too much time • I can’t afford it • What’s the point

49. Disaster Due Diligence Newsletter

50. this country’s emergency management focus • Tends toward response and recovery during and aftera disaster. • Firestorm remains focused on establishing nation-wide readiness before disaster strikes. • Goal: Build strong Disaster Ready People and Disaster Ready Businesses.