Author: Lucien Canton
Three vital parts of an emergency message
My wife and I were spending a quiet evening watching one of our favorite shows when the program was interrupted by an emergency alert system message. The message concerned two children who had been abducted from their home in a nearby Bay Area community. The message provided the names and ages of the children and the name of the woman that had kidnapped them. Unfortunately, that was all the information that the message provided.
When the program resumed, my wife and I looked at each other and marveled that such a useless message could have been sent out using the emergency alert system. There was no information about how the kidnapper was traveling, where she was bound, or any description of her or the children. In other words, there were no cues that a citizen could use to identify either the kidnapper or the children besides the fact that she was a woman of indeterminate age traveling with two children.
I have seen this problem occur all too often with emergency messages. In a rush to use the system, we sometimes neglect to determine what message we want to send to the public and, more importantly, what actions we want them to take. If we think back to the messages we received following 9/11, we see the same problem: a warning with little real content and no recommended protective action.
In crafting your emergency message you need to keep in mind three basic questions that the public wants answered:
- What has happened?
- What does it mean to me?
- What can I do about it?
These three basic questions are at the heart of any successful message.Keep them in mind and your message has a better chance of being heard and acted upon. Neglect them and you end up with a message that is at best confusing and at worst generates alarm and concern in the recipient.
Is your emergency plan real?
As many of my readers know, my hobby and interests revolve around the history of the Middle Ages. So it was a real treat to visit the Royal Armory in Madrid, one of the premier collections of armor and weapons in Europe. There were some amazing examples of the armor makers art and I spent quite some time examining them. There was just one thing a bit troubling – none of it (well, most of it) was real.
Now, I'm not knocking the Royal Armory. The exhibit is amazing and worth seeing. However, my interest is in munitions grade armor – the stuff you could fight in. On display were suits of parade armor and others designed for jousting, a very specific type of mock combat. This type of armor was never intended to be used in combat. Indeed, they would have offered some serious disadvantages to the fighter if they were so used.
So here's the question for you: is your emergency plan "munitions grade" of only for parade?
One of the problems I see when I assess emergency plans is that many of them are written for review by a higher authority. Like parade armor, they really won't work well when relied on in a crisis. The planners make the mistake of focusing on requirements rather than on reality, forgetting that, in many cases, the "requirements" are actually guidelines.
An effective plan starts with the needs of the organization and builds out, incorporating guidelines as necessary and using them as a means of quality control. It doesn't start with the guidelines and "filling the blanks".
The true purpose of medieval armor was to give a warrior an advantage in a crisis. It's the same for the emergency plan. If your plan looks good and meets all requirements but cannot be used in a crisis, it's like parade armor. It looks really good but it won't give you an edge in surviving a crisis.
What a light switch can teach us about ICS
During a recent visit to my brother-in-law in Ireland, I realized that I had left my book in the living room. It was late at night and the house was dark. As I entered the room I reached for where the light switch should have been. Nothing. I tried the other wall. Same result. Eventually, I gave up, stumbled around in the darkened room and found my book. It was only when I returned to my bedroom that I remembered that in many Irish and English houses light switches are outside the room entrance. (They also have switches on wall plugs, which add a whole new dimension to trying to recharge electronics.)
What's this got to do with ICS? We have an expectation that since we are all using the incident command system in the US that we should be able to seamlessly integrate mutual aid agencies. However, as Dr. Jessica Jensen has shown in her research on ICS, very few of us apply it in exacly the same way. However, we expect that everyone will respond in exactly the same way we do, just as I expected the light switch to be where it was supposed to be. We forget that different jurisdictions do things differently. It is these jurisdictional differences that can cause friction during a mutual aid response.
The answer to much of this is to do joint exercises. However, this is not always feasible, particularly if you're attempting to integrate Federal resources in a major disaster. In these events the role of the liaison officer becomes extremely important. Unfortunately, we do little training for liaison officers and focus mainly on using them as points of contact. Instead, give some thought to how the liaison officer can help identify and ease operational differences.
Airport security depends on depth
In a recent post I wrote about a young stowaway who managed to penetrate security at a California airport and somehow survived a flight to Honolulu in the aircraft wheel well. This prompted a message from my friend and colleague Jeff Whitman from Air Safety Group.Jeff is an expert on aviation safety and security and I thought his comments might be of interest to you:
I think of safety and security as the obnoxious twins. Both can be annoying and certainly require effort to manage. These siblings are nearly identical. The primary difference is security protects us from others, while safety protects us from ourselves.
You spoke of layers of defense in your recent blog. I break these layers into two high-level categories, avoidance barriers and recovery barriers.
I find people need help understanding how/where to apply their barriers.
Avoidance barriers need to be applied well upstream of the potential consequence. In simplest terms, avoidance barriers defend against the triggers that cause the undesirable operational states (UOS). Recovery barriers are how we minimize the effects of reaching the UOS, after the avoidance barriers fail.
In the example of the 15 year-old breaching airport security, the teen reaching the aircraft could be considered one of many UOS, the consequence in this case, was a stowaway. There are other consequences that could have been much worse!
In order to defend against the UOS, we need to understand the hazard components (triggers) that allowed the teen to reach the aircraft (UOS). In this case, one of the hazard components is unauthorized access to the ramp. In theory, a person with authorized access to the ramp could have also reached the same (or similar) UOS, so this analysis tree has growth potential.
Pop quiz: What is the hazard in this scenario?
This is a very important question, because without accurately identifying the hazard, the potential for reducing risk is limited, at best.
Continuing with the stowaway example, adding the fence is clearly an avoidance barrier. Unfortunately, it failed. Why?
This is where the recovery barriers should kick in and protect against the fact that we’ve reached the UOS. In this case, there were recovery barriers in place, (security cameras), but they failed too. Why?
The classification of hazards, triggers, UOS, and consequence may shift, depending on where the analyst sits in the business process. For example, the persons responsible for the fence may identify the UOS as unauthorized ramp access and the hazard component as fence height. Without dragging on too long, the hazard and risk analysis tree can get pretty complicated.
Teen stowaway shakes up airport security
SAS in North Africa WW II
By now you’ve probably heard about the 15-year-old boy who stowed away in the wheel well of a jet aircraft bound for Honolulu from San Jose and the questions it has raised about security at US airports. I believe there are two very important lessons we can learn from this.
One of the myths that has been sold to the American public is the belief that they can be protected from everything. We’ve raised expectations to such a level that when things go wrong, as they inevitably do, the public feels betrayed. However, any security expert will tell you that there is no such thing as a foolproof system. That’s why we work in layers. The purpose of any security system is first to deter penetration of the facility. The second is to detect the attempted penetration and, finally, to delay the attacker long enough for a response to be mounted. However, inherent in any system is the risk that an extremely motivated attacker will be able to penetrate the system, something that we keep from the public.
So the fact that a 15-year-old boy could breach an airport perimeter by hopping a fence in the dark would not have been an issue if the system had been able to detect and delay him until security personnel arrived. This failure leads to the second point that I would like to make that of focusing on the expected rather than the unexpected.
The attacks of September 11 occurred onboard aircraft so the focus of all our security planning has largely been on passengers. We have considered the threat of terrorists on board an aircraft and the placement of bombs in luggage. However, we initially neglected the screening of the many vendors and workers that had access to restricted areas not open to passengers and there’s been little attention to the larger perimeter, partially because of the extreme cost that would be involved.
Yet an attack through an airport perimeter is not something that cannot be foreseen. On the morning of September 11 I was at a conference on infrastructure protection and we were discussing the tactics used by the special air service in World War II in their raids on German and Italian airfields. These attacks were made by breaching the perimeter and destroying parked aircraft with explosives and heavy weapons fire. Our assumption that airport attacks will always be against passengers and take place in the air is not particularly valid. Destroying multiple aircraft on the ground would have a significant cost both in damages and in future preventive security measures as well as profound psychological impact on air travelers.
This was not a failure of security. It was rather a failure to consider alternative means of attack, to think beyond past experience. To allow ourselves to focus solely on methods that have been used in the past is to leave ourselves vulnerable to the unexpected. And that is something we cannot afford to do.
Related articles
San Francisco proposes earthquake bond to fix water supply
Last week I wrote about concerns raised a San Francisco Chronicle investigation regarding the City's ability to fight major fires following an earthquake. Shortly after the investigative article was published, Naomi Kelly, the City Administrator for San Francisco, submitted a letter to the editor of the Chronicle responding to the concerns raised by the investigation.
Mrs. Kelly made it clear that improving and upgrading the firefighting infrastructure in San Francisco was a very clear priority for the city and that, far from ignoring the problem, City officials are actively engaged in solving the problem. Mrs. Kelly pointed out that the City maintains an earthquake safety and emergency response program to fund repairs and improvements to the City's response capabilities, including the emergency firefighting water supply system and other earthquake safety related infrastructure.As chair of the Capital Planning Committee, Mrs. Kelly helps to oversee this work.
in 2010, voters overwhelming passed a $20 million bond to provide funding for improvements to the emergency firefighting water supply system, public safety buildings, and to the neighborhood fire stations.
Mrs. Kelly further noted that voters in San Francisco will get a chance in June to vote on the second phase of these improvements. The City has proposed a $400 million earthquake safety and emergency response bond for inclusion on the June 2, 2014 ballot.
While are still much work to do to improve San Francisco's response infrastructure, it is heartening to know what San Francisco officials are well aware of the problem and are in fact doing something about.
Will San Francisco burn in the next earthquake?
San Francisco’s Official Seal bears the image of a phoenix, the mythical bird that is reborn from its own ashes. It’s an appropriate device as San Francisco burned to the ground six times prior to the earthquake and fire in 1906.
However, while the City was rebuilt and improved, the lessons of those fires were soon forgotten. By 1906, a system of cisterns that had been built in the 1860’s had been allowed to fall into disrepair, the assumption being that new firefighting apparatus made them unnecessary. Warnings of potential conflagration from the Chief Engineer, Dennis Sullivan, were ignored and City officials refused to fund the necessary resources to prepare for the coming disaster.
History has a way of repeating itself.
A recent San Francisco Chronicle report casts doubt on the City’s ability to fight fires after an earthquake. According to the report, the San Francisco Fire Department has only enough resources to fight three major fires at one time.
Following the earthquake and fire in 1906, the City implemented many of Chief Sullivan’s recommendations. The City installed a high-pressure water system that was independent of the municipal water system and could be fed by gravity from tanks on the hills or draft seawater directly from the Bay. However, as the City has grown, it has outstripped the capacity of this system, putting much of the residential area of the City is at risk.
The solution was to expand the system of underground cisterns to almost 200, each holding 75,000 gallons. The problem is that only one rig at a time could hook up to the cisterns and they are not always located near the fire. In the 1980’s a local battalion chief, Frank Blackburn, cobbled together a solution that would eventually become known as the Portable Water Supply System (PWSS), an above ground portable hydrant system that could pump high pressure water across half a mile wherever it was needed.
The PWSS has proved its worth. It is the system that, along with the fireboat Phoenix, is credited with saving the Marina District in the 1989 Loma Prieta earthquake. It was also used in the Berkeley Hills fire in 1991 and, most recently, in a rare (for San Francisco) five-alarm fire in Mission Bay that eventually required 7 million gallons of water to extinguish.
So what’s the problem? As you would expect, it’s a question of funding priorities. Although other cities have floated bonds to invest in the system, San Francisco does not consider the system a capital expense and requires that the PWSS be handled within the SFFD budget. A request for $9 million for the system in 2010 was turned down. The PWSS remains at essential the same level it was at in 1989 when it was experimental.
It's not hard to see parallels to 1906. Let's hope that City officials see it as well.