Serving Through Disaster

Continuity planning is the new mantra in disaster planning, helping to keep key services alive

By Raya Kuzyk -- Library Journal, 03/15/2007

When a flash flood took out the basement of the University of Hawaii at Manoa Library (UHML) in October 2004, a disaster plan had been in place for ten years and was being regularly reviewed and updated. So you'd think UHML would have had most of its bases covered. Although the preservation department successfully recovered much of the collection, the significant damage to service was unanticipated. Sixty staff work areas were destroyed and had to be relocated, and the staff had to shelve books in the dark for three months owing to the loss of electricity. The library's longstanding and routinely rehearsed disaster plan hadn't accounted for this great a blow to library service and function.

Disaster planning focuses on future function and recovery, on helping libraries expeditiously return to their original states of operation. It all but ignores the concept of continuous function throughout a disaster. This is not true in the private and government sectors, however, which have managed to cover a wider load of disaster response preparedness through the implementation of what we'll here refer to as business continuity planning, or BCP (also known as business systems continuity, business continuity management, business continuity and recovery, and continuity of operations).

For these sectors, BCP sprang from basic cost-benefit analysis. More than just time and money are at risk when a business is forced to shut down in a disaster: the longer a business stays dark, the more likely its customers and vendors are to turn to local competitors. Worse still, temporary shutdowns too often take a permanent turn. According to the Institute for Business and Home Safety, 43 percent of all businesses involved in local disasters never reopen. That's why many in the private sector—especially those in information technology, insurance, finance, warehousing, and manufacturing—have opted for something more than the wherewithal to pick up the pieces after a disaster; they intend to keep afloat all the while.

A large-scale example of the gap between disaster and continuity planning is best illustrated by a large-scale disaster: 9/11. Following the attacks, the cost of losses and recovery for Citicorp, which had had a standard disaster plan in place, was estimated at $700 million. In contrast, American Express, which had implemented a continuity plan well in advance, bounced back, its service uninterrupted and virtually uncompromised. At the first sign of trouble, a backup facility in Arizona successfully transferred critical data to duplicate applications and staff outside the New York region.

But this is big business, the elite few. A study of a larger swathe of business types and sizes points to a less optimistic reality. In its 2001–06 U.S. Business Continuity and Disaster Recovery Focus Report, Gartner Dataquest concluded that upward of 30 percent of all U.S. businesses had inadequate or nonexistent continuity and disaster plans. U.S. libraries, the subject of a study by the Heritage Health Index, lag even farther behind. Seventy percent, says the report, do not even have a disaster plan in place.

This explains why the concept of BCP has only recently entered the library lexicon (cost and scale are no small factors, either—Hewlett-Packard's expenditure of $100 million on “business continuity and recovery centers” sets an impossible precedent). But what if libraries were to appropriate the BCP concept, redefining it in a context they could afford to think about? Several librarians have already asked themselves that question and are making headway.

Since 2000, the New York Public Library (NYPL)—the Research Libraries and the Branch Libraries—and the research libraries of Columbia and Princeton universities have been storing their low-use items in a jointly owned, funded, and controlled high-density book-shelving facility in Princeton, inspired by the Harvard Depository model. The Research Collections and Preservation (ReCAP) Consortium, as it is called, is the only repository consortium merger between academic and nonacademic libraries. When the ReCAP Board of Directors recently sat down to discuss disaster preparedness measures, BCP informed their philosophy and approach.

“Business continuity spoke to a lot of questions we were already asking,” says Jacob Nadal, who as field service librarian at the Barbara Goldsmith Preservation Division of NYPL researched the disaster-preparedness approach on ReCAP's and his own library's behalf. The consortium's members decided to view ReCAP not just as a remote storage site but as a means of continuing to serve materials to the New Jersey and New York libraries throughout a disaster. Instead of freezing their combined resources for the long term, they decided to think more about organizing these items with a priority on the easiest and most immediate access to what's likely to be needed first in an emergency. They are also investigating redundant systems for temporary web sites as well as call bridges and call-in hotlines. “The communication aspect of disaster planning,” says Nadal, “usually assumes that all the old ways of communicating are still working, but what happens if cell service is down or the system network is no longer functional?”

Nadal encourages librarians to start thinking seriously about their organizational priorities, suggesting they not only agree on what's necessary in the face of a disaster but entertain a more frightening prospect: How awful would it be if they could do only the things they had deemed “necessary”? That scenario may be too shallow, says Nadal, and he urges librarians to think one hypothetical beyond “what if”—to “what then.” He believes that would spur them into scrapping the old plan and starting over, with a bigger, broader view.

All this does not mean disaster planning should go by the wayside. According to Peter Gerr, senior analyst at the Enterprise Strategy Group consulting firm, the best front against an attack is, once again, a united one. Asked in a 2004 Public Relations Quarterly interview what his personal vision was for optimal disaster mitigation, Gerr said he saw “data protection, disaster recovery, and business continuity as intersecting circles,” a kind of fortifying the castle from all sides.

Anne M. Candreva, CIO of the Brooklyn Public Library (BPL), who oversees many aspects of BPL's disaster plan, thinks such distinctions are no longer even necessary. “We may not use the term continuity planning, but, these days, disaster planning is continuity planning,” she says. “If the three components of disaster planning are preparation, mitigation, and recovery, the recovery component would be the continuity part. The question of how quickly we can get back on our feet has turned into how can we make sure to stay there in the first place.”

BPL knows whereof it speaks. Leading up to the New York City transit strike of 2005, BPL, one of the largest library systems in the country, was prepared to stay open, no matter the length of the negotiations. No easy feat since many of its staff members worked in one borough and lived in another. But BPL had already worked out a plan with NYPL and the Queens Library that extended systemwide. The administration thought a great solution would be for employees to report to the nearest library in the system regardless of where they worked and contact their supervisors to let them know where they'd ended up (this meant, among other things, updating web site and contact information, mapping out possible routes, and, in some cases, arranging car pools days in advance). “It could have been crippling,” says Candreva of the strike, which immobilized all subway and bus service for two days, “but it was seamless.”

BPL administrators haven't only just begun thinking this way. Once a year, the staff meets to reevaluate its disaster plan. Last year, when its BCP consultant's contract expired, the library initiated talks with the Department of Information Technology and Telecommunication (DOITT), which oversees the city's use of technologies in government operations and its delivery of services to the public. Though nothing has yet been set in motion, DOITT could offer invaluable assistance in the area of business continuity. For example, it could host the library's email servers at a hard data center designed to withstand extreme damage. “They have many more resources than we do,” says Candreva, “so if we're really serious about rethinking our disaster plan, why not leverage that for a higher level of protection?”

Also considering a greater commitment to disaster mitigation is the Ohio Library and Information Network (OhioLINK), a consortium of Ohio's college and university libraries and the State Library of Ohio. Technical director Tom Sanville, who both writes and updates all of OhioLINK's disaster-planning documents, says the consortium recently conferred with the Ohio Supercomputer Center, one of its technology partners, about setting up a mirror site at one of the center's nearby locations, some 50 miles away. “If it's a true mirror,” he says, “it would reflect within milliseconds the status of the central production site and could be put into production within minutes. Or,” he offers, mentioning high cost, “we could have a less up-to-date system that could serve as a warm or dark site. The mirror site is truly what we want, but we are not there yet.”

The arguments for factoring BCP into the disaster preparedness equation are compelling. A business conglomerate may have a fatter wallet to sit on, but it's unlikely to be supporting the weight of an entire community as libraries do. Case in point: in Katrina's aftermath, the functioning of the barely damaged Terrebonne Parish Library in Houma, LA, proved critical. In the course of a single month, thousands of evacuees to the Terrebonne Civic Center steadily migrated into the main library building just 100 yards away. They went there to communicate with loved ones, consult vital resources, keep their business affairs in order, and congregate for support. The center may have been the designated go-to place, but the library, as that agora of hectic everyday life, proved an intuitive and essential haven. And this is only one example of the many critical services libraries provided throughout the aftermath of Katrina and Rita.

If the notion of business continuity seems daunting, consider that it need not be a full-time, full-service affair. NYPL's Nadal says, “It could just be about whatever says that your library is open—the web site being up or the catalog running.” To help determine what that is, exactly, Nadal suggests librarians in systems of all sizes ask themselves this: “Is our function to keep books for posterity, to circulate books, or to provide a community—and how do these things relate?”

Additionally, continuity doesn't have to entail relocating business operations like American Express did. It can work on a less comprehensive scale. For example, available services and resources could be situated at or around the original site of the disaster, via bookmobiles and borrowed collections from unaffected libraries. Similarly, just keeping staff relatively congregated and offering assistance—minus the building, minus even the books—would, in the event of a large-scale disaster, reassure and be invaluable to those who know their library not so much by its books, say, as by the people who offer them.

Networking is a smart start, not just for its potential to foster cost-effective solutions and resource-sharing but for the resilience it helps secure against disaster. The more supports a library has in its immediate reach, the sturdier it will stand, regardless of how hard or which way the wind blows. Combining forces also broadens access to individuals in a community, seriously increasing the impact a library can have on helping everyone else get back on their feet.

The number of consortial arrangements is only growing. California and Ohio are both leading the way in the formation of statewide library networks that incorporate library depositories into their services. Examples of similar cooperative action are the Five-College Depository Library of Massachusetts, Washington Research Library Consortium, and Minnesota Library Access Center.

Imagine the potential for aid among consortium members should one party be affected by disaster. Examples to look to in this regard are the Inland Empire Libraries Disaster Response Network (IELDRN) and San Diego/Imperial County Libraries Disaster Response Network (SILDRN), which have mutual aid agreements that allow them to share supplies and provide aid to participants in the event of an emergency.

In considering potential partners, librarians should not feel limited strictly to choosing other libraries (although, to be sure, the match is a good one). When asking themselves where their organization connects to others, librarians can also look to their communities for network-linking possibilities.

Nadal advises partnering with local services—shelters, community aid groups, and, especially, if not surprisingly, churches: “They're very well connected, they're used to reaching professional first responders for people in crisis, they have an especially close relationship with hospitals,” he says. “Most important, they're a landmark; people in trouble know immediately to turn there.” This by no means, however, renders the million-dollar conglomerate irrelevant. Nadal believes the fullest potential in continuity is through an unconventional approach. “Be a little crazy,” he says. “Think of the Barnes & Noble down the street—maybe they'd want to work with you.”

BCP is today more possible than ever for businesses of every size, including libraries, not least because of the preponderance of virtual libraries. Librarians should take advantage of this growing knowledge base by looking to smaller-sized private-sector businesses with similar concerns. Take a first step: attend BCP workshops. Get certified in BCP, as Nadal did, through the Disaster Recovery Institute International (DRII). Those training courses cost from $1495 to $4550. (Too much? If you'd rather train on your own, you can get certified through DRII for as little as $575.) Or try for the go-ahead from management to meet with a private BCP consultant, many of whom are likely to offer a free first-time consultation with enough institutional interest. Scout out other locations for mutual backup arrangements. Meet with local professional first responders. Research various vendor contracts (e.g., for enhanced technology maintenance) as well as state or local agency recovery assistance. And routinely test and update and communicate management plans and procedures.

There are all the obvious stumbling blocks: more immediate priorities, governance issues, each institution's own set of budget constraints, and logistical problems. But Nadal, for one, feels strongly about the need to attempt continuity planning now. “This is not a case of another acronym, another buzzword descending on us,” he says. “Disaster planning has gone beyond worrying about wet books.” The initiation of discussion alone will engage a more serious commitment, encouraging ideas and throwing the gates open to a steady and multidirectional stream of information sharing. That is something at which librarians are exceptionally good. The first step is one of many necessary moves out of harm's way.