April 20, 2018

Serving Through Disaster

Continuity planning is the new mantra in disaster planning, helping to keep key services alive

When a flash flood took out the basement of the University of Hawaii at Manoa Library (UHML) in October 2004, a disaster plan had been in place for ten years and was being regularly reviewed and updated. So you’d think UHML would have had most of its bases covered. Although the preservation department successfully recovered much of the collection, the significant damage to service was unanticipated. Sixty staff work areas were destroyed and had to be relocated, and the staff had to shelve books in the dark for three months owing to the loss of electricity. The library’s longstanding and routinely rehearsed disaster plan hadn’t accounted for this great a blow to library service and function.

Disaster planning focuses on future function and recovery, on helping libraries expeditiously return to their original states of operation. It all but ignores the concept of continuous function throughout a disaster. This is not true in the private and government sectors, however, which have managed to cover a wider load of disaster response preparedness through the implementation of what we’ll here refer to as business continuity planning, or BCP (also known as business systems continuity, business continuity management, business continuity and recovery, and continuity of operations).

For these sectors, BCP sprang from basic cost-benefit analysis. More than just time and money are at risk when a business is forced to shut down in a disaster: the longer a business stays dark, the more likely its customers and vendors are to turn to local competitors. Worse still, temporary shutdowns too often take a permanent turn. According to the Institute for Business and Home Safety, 43 percent of all businesses involved in local disasters never reopen. That’s why many in the private sector – especially those in information technology, insurance, finance, warehousing, and manufacturing – have opted for something more than the wherewithal to pick up the pieces after a disaster; they intend to keep afloat all the while.

A large-scale example of the gap between disaster and continuity planning is best illustrated by a large-scale disaster: 9/11. Following the attacks, the cost of losses and recovery for Citicorp, which had had a standard disaster plan in place, was estimated at $700 million. In contrast, American Express, which had implemented a continuity plan well in advance, bounced back, its service uninterrupted and virtually uncompromised. At the first sign of trouble, a backup facility in Arizona successfully transferred critical data to duplicate applications and staff outside the New York region.

But this is big business, the elite few. A study of a larger swathe of business types and sizes points to a less optimistic reality. In its 2001 – 06 U.S. Business Continuity and Disaster Recovery Focus Report, Gartner Dataquest concluded that upward of 30 percent of all U.S. businesses had inadequate or nonexistent continuity and disaster plans. U.S. libraries, the subject of a study by the Heritage Health Index, lag even farther behind. Seventy percent, says the report, do not even have a disaster plan in place.

This explains why the concept of BCP has only recently entered the library lexicon (cost and scale are no small factors, either – Hewlett-Packard’s expenditure of $100 million on ‘business continuity and recovery centers’ sets an impossible precedent). But what if libraries were to appropriate the BCP concept, redefining it in a context they could afford to think about? Several librarians have already asked themselves that question and are making headway.

Forging alliances

Since 2000, the New York Public Library (NYPL) – the Research Libraries and the Branch Libraries – and the research libraries of Columbia and Princeton universities have been storing their low-use items in a jointly owned, funded, and controlled high-density book-shelving facility in Princeton, inspired by the Harvard Depository model. The Research Collections and Preservation (ReCAP) Consortium, as it is called, is the only repository consortium merger between academic and nonacademic libraries. When the ReCAP Board of Directors recently sat down to discuss disaster preparedness measures, BCP informed their philosophy and approach.

‘Business continuity spoke to a lot of questions we were already asking,’ says Jacob Nadal, who as field service librarian at the Barbara Goldsmith Preservation Division of NYPL researched the disaster-preparedness approach on ReCAP’s and his own library’s behalf. The consortium’s members decided to view ReCAP not just as a remote storage site but as a means of continuing to serve materials to the New Jersey and New York libraries throughout a disaster. Instead of freezing their combined resources for the long term, they decided to think more about organizing these items with a priority on the easiest and most immediate access to what’s likely to be needed first in an emergency. They are also investigating redundant systems for temporary web sites as well as call bridges and call-in hotlines. ‘The communication aspect of disaster planning,’ says Nadal, ‘usually assumes that all the old ways of communicating are still working, but what happens if cell service is down or the system network is no longer functional?’

Nadal encourages librarians to start thinking seriously about their organizational priorities, suggesting they not only agree on what’s necessary in the face of a disaster but entertain a more frightening prospect: How awful would it be if they could do only the things they had deemed ‘necessary’? That scenario may be too shallow, says Nadal, and he urges librarians to think one hypothetical beyond ‘what if’ – to ‘what then.’ He believes that would spur them into scrapping the old plan and starting over, with a bigger, broader view.

It’s disaster planning, plus

All this does not mean disaster planning should go by the wayside. According to Peter Gerr, senior analyst at the Enterprise Strategy Group consulting firm, the best front against an attack is, once again, a united one. Asked in a 2004 Public Relations Quarterly interview what his personal vision was for optimal disaster mitigation, Gerr said he saw ‘data protection, disaster recovery, and business continuity as intersecting circles,’ a kind of fortifying the castle from all sides.

Anne M. Candreva, CIO of the Brooklyn Public Library (BPL), who oversees many aspects of BPL’s disaster plan, thinks such distinctions are no longer even necessary. ‘We may not use the term continuity planning, but, these days, disaster planning is continuity planning,’ she says. ‘If the three components of disaster planning are preparation, mitigation, and recovery, the recovery component would be the continuity part. The question of how quickly we can get back on our feet has turned into how can we make sure to stay there in the first place.’

BPL knows whereof it speaks. Leading up to the New York City transit strike of 2005, BPL, one of the largest library systems in the country, was prepared to stay open, no matter the length of the negotiations. No easy feat since many of its staff members worked in one borough and lived in another. But BPL had already worked out a plan with NYPL and the Queens Library that extended systemwide. The administration thought a great solution would be for employees to report to the nearest library in the system regardless of where they worked and contact their supervisors to let them know where they’d ended up (this meant, among other things, updating web site and contact information, mapping out possible routes, and, in some cases, arranging car pools days in advance). ‘It could have been crippling,’ says Candreva of the strike, which immobilized all subway and bus service for two days, ‘but it was seamless.’

BPL administrators haven’t only just begun thinking this way. Once a year, the staff meets to reevaluate its disaster plan. Last year, when its BCP consultant’s contract expired, the library initiated talks with the Department of Information Technology and Telecommunication (DOITT), which oversees the city’s use of technologies in government operations and its delivery of services to the public. Though nothing has yet been set in motion, DOITT could offer invaluable assistance in the area of business continuity. For example, it could host the library’s email servers at a hard data center designed to withstand extreme damage. ‘They have many more resources than we do,’ says Candreva, ‘so if we’re really serious about rethinking our disaster plan, why not leverage that for a higher level of protection?’

Also considering a greater commitment to disaster mitigation is the Ohio Library and Information Network (OhioLINK), a consortium of Ohio’s college and university libraries and the State Library of Ohio. Technical director Tom Sanville, who both writes and updates all of OhioLINK’s disaster-planning documents, says the consortium recently conferred with the Ohio Supercomputer Center, one of its technology partners, about setting up a mirror site at one of the center’s nearby locations, some 50 miles away. ‘If it’s a true mirror,’ he says, ‘it would reflect within milliseconds the status of the central production site and could be put into production within minutes. Or,’ he offers, mentioning high cost, ‘we could have a less up-to-date system that could serve as a warm or dark site. The mirror site is truly what we want, but we are not there yet.’

A case for BCP

The arguments for factoring BCP into the disaster preparedness equation are compelling. A business conglomerate may have a fatter wallet to sit on, but it’s unlikely to be supporting the weight of an entire community as libraries do. Case in point: in Katrina’s aftermath, the functioning of the barely damaged Terrebonne Parish Library in Houma, LA, proved critical. In the course of a single month, thousands of evacuees to the Terrebonne Civic Center steadily migrated into the main library building just 100 yards away. They went there to communicate with loved ones, consult vital resources, keep their business affairs in order, and congregate for support. The center may have been the designated go-to place, but the library, as that agora of hectic everyday life, proved an intuitive and essential haven. And this is only one example of the many critical services libraries provided throughout the aftermath of Katrina and Rita.

If the notion of business continuity seems daunting, consider that it need not be a full-time, full-service affair. NYPL’s Nadal says, ‘It could just be about whatever says that your library is open – the web site being up or the catalog running.’ To help determine what that is, exactly, Nadal suggests librarians in systems of all sizes ask themselves this: ‘Is our function to keep books for posterity, to circulate books, or to provide a community – and how do these things relate?’

Additionally, continuity doesn’t have to entail relocating business operations like American Express did. It can work on a less comprehensive scale. For example, available services and resources could be situated at or around the original site of the disaster, via bookmobiles and borrowed collections from unaffected libraries. Similarly, just keeping staff relatively congregated and offering assistance – minus the building, minus even the books – would, in the event of a large-scale disaster, reassure and be invaluable to those who know their library not so much by its books, say, as by the people who offer them.

Power in numbers

Networking is a smart start, not just for its potential to foster cost-effective solutions and resource-sharing but for the resilience it helps secure against disaster. The more supports a library has in its immediate reach, the sturdier it will stand, regardless of how hard or which way the wind blows. Combining forces also broadens access to individuals in a community, seriously increasing the impact a library can have on helping everyone else get back on their feet.

The number of consortial arrangements is only growing. California and Ohio are both leading the way in the formation of statewide library networks that incorporate library depositories into their services. Examples of similar cooperative action are the Five-College Depository Library of Massachusetts, Washington Research Library Consortium, and Minnesota Library Access Center.

Imagine the potential for aid among consortium members should one party be affected by disaster. Examples to look to in this regard are the Inland Empire Libraries Disaster Response Network (IELDRN) and San Diego/Imperial County Libraries Disaster Response Network (SILDRN), which have mutual aid agreements that allow them to share supplies and provide aid to participants in the event of an emergency.

Thinking outside the call box

In considering potential partners, librarians should not feel limited strictly to choosing other libraries (although, to be sure, the match is a good one). When asking themselves where their organization connects to others, librarians can also look to their communities for network-linking possibilities.

Nadal advises partnering with local services – shelters, community aid groups, and, especially, if not surprisingly, churches: ‘They’re very well connected, they’re used to reaching professional first responders for people in crisis, they have an especially close relationship with hospitals,’ he says. ‘Most important, they’re a landmark; people in trouble know immediately to turn there.’ This by no means, however, renders the million-dollar conglomerate irrelevant. Nadal believes the fullest potential in continuity is through an unconventional approach. ‘Be a little crazy,’ he says. ‘Think of the Barnes & Noble down the street – maybe they’d want to work with you.’

Not just for big business

BCP is today more possible than ever for businesses of every size, including libraries, not least because of the preponderance of virtual libraries. Librarians should take advantage of this growing knowledge base by looking to smaller-sized private-sector businesses with similar concerns. Take a first step: attend BCP workshops. Get certified in BCP, as Nadal did, through the Disaster Recovery Institute International (DRII). Those training courses cost from $1495 to $4550. (Too much? If you’d rather train on your own, you can get certified through DRII for as little as $575.) Or try for the go-ahead from management to meet with a private BCP consultant, many of whom are likely to offer a free first-time consultation with enough institutional interest. Scout out other locations for mutual backup arrangements. Meet with local professional first responders. Research various vendor contracts (e.g., for enhanced technology maintenance) as well as state or local agency recovery assistance. And routinely test and update and communicate management plans and procedures.

There are all the obvious stumbling blocks: more immediate priorities, governance issues, each institution’s own set of budget constraints, and logistical problems. But Nadal, for one, feels strongly about the need to attempt continuity planning now. ‘This is not a case of another acronym, another buzzword descending on us,’ he says. ‘Disaster planning has gone beyond worrying about wet books.’ The initiation of discussion alone will engage a more serious commitment, encouraging ideas and throwing the gates open to a steady and multidirectional stream of information sharing. That is something at which librarians are exceptionally good. The first step is one of many necessary moves out of harm’s way.

Jacob Nadal On Business Continuity

NYPL’s planner reflects on the potential for BCP for library service

‘I learned an interesting lesson about disaster preparedness at the very first library job I had, before I even went to library school. That library served hundreds of people every day, and one of those days – during reading season – the network went down. A couple of librarians who were really on top of their game started conducting what you might call on-the-spot BCP. They assigned tasks to staff, kept people who had recently shelved close at hand, made sure people knew the reference desk was still open, and kept it up and running.

They had us notify all the collection managers whose materials were affected, made sure circulation knew what to do, immediately notified library administration, and documented the entire incident. But then we all learned after bumping into the head of interlibrary loan (ILL) operations that we’d been swamped from both ends: we were being flooded with all the usual requests but also with extra requests from people outside our organization. Had we found all those layers before we reached crisis mode, we’d have been able to navigate the situation better. Your organization extends much further than you think.

Walk through the whole organizational chart, and you find not only connections you’ve established but ones that grow out of that – and you need all those little pieces. Every unit in a library has this common investment in and need for each collection. The way all of us see a collection may be different, but it’s not exclusive. You need all those little pieces existing in all the ways they can. The beautiful thing about business continuity is that it keeps adding those little pieces.

‘Librarians recognize the need for every possible type of media and information. Many of them, in anticipation of a disaster cutting off their normal lines of communication, are beginning to look at automated calling system software that supports notification procedures. We’re learning with every passing year that good notification makes a tremendous difference in how a library fares in a disaster. Programs are bursting at the seams, interest is in the air; the more we can do to integrate what’s out there, the stronger – the healthier – we are. Specialists are invaluable and always will be, but there has to be a broad identity within the library profession related to our role as stewards and keepers. BCP fits nicely with that; it recognizes that an organization is interconnected. I’m constantly looking to what’s happening with web start-ups, successful tech companies, the thinking in the private sector. What makes them agile, successful? Our approach to disaster planning will always benefit from the mentality of connections, overlapping interests, a broad understanding of what’s going on. Libraries operate that way – we’re all committed, not staffed. Here’s a job where every day, everything changes. Taking joy in the flexibility and changes creates an exciting opportunity for us.’

Raya Kuzyk is a Brooklyn-based freelance writer


The Business Continuity Institute www.thebci.org

CPM Group www.contingencyplanning.com

Disaster Recovery Journal www.drj.com

Disaster Recovery International Institute www.drii.org

Disaster Resource Guide www.disaster-resource.com

Federal Emergency Management Agency www.fema.gov

The Security Portal for Information System Security Professionals www.infosyssec.net/infosyssec/security/buscon1.htm

Survive – The Business Continuity Group www.survive.com

Dates to note

May Day AMIA Disaster Prevention and Recovery Sub-Committee ‘Call to Action’; palimpsest.stanford.edu/byform/mailing-lists/padg/2006/04/doc00002.doc

July Bioterrorism/Disaster Education and Awareness Month; www.mhprofessional.com/?page=/mhp/categories/chases/content/special_months.html

September National Preparedness Month; www.sba.gov/npm2005

The Latest Trends in Library Design
Hosted in partnership with Salt Lake County Library and The City Library—at SLCo’s Viridian Center—the newest installment of our library building and design event will let you dig deep with architects, librarians, and vendors to explore building, renovating, and retrofitting spaces to better engage your community.
Engagement Marketing: Put Your Library’s Story to Work
Telling your library’s story is a powerful way to engage your audiences and demonstrate impact. Learn how to tell your library’s story and effectively use social media, innovative tech tools, and crucial partnerships to move your library’s marketing strategy from promotion to engagement in this multi-week online course—May 16 & 30, 2018.