SMT Online Web Exclusive

CONTEST2: is the Government doing enough to combat terrorism?

29 Jun 09

At first sight, CONTEST2 appeared to be a welcome expansion of the manpower available to deal with terrorist incidents but, when scratching below the surface, many commentators feel it lacks detail. Andrea Kirkby listens to their views.

By Andrea Kirkby

The Government’s recent announcement concerning an updated counter-terrorism strategy – CONTEST2 – and the training of 60,000 civilians in responding to the terrorist threat was widely reported in the mainstream media. Not to mention by SMT Online, of course!

George Cook – the chief executive of Community Resilience – finds it extremely interesting (and telling) that the statement on the Government’s plans was made by (then) Home Secretary Jacqui Smith when in truth it’s the Cabinet Office that holds responsibility for civil contingencies. Cook believes joined-up Government is yet to arrive in this area.

“It’s all fragmented and rather incoherent, isn’t it?” Cook told SMT Online. “I’m left with the impression that the Government really doesn’t have this area under control at all.” Cook also pointed out that the Department of Culture, Media and Sport has responsibility for rest centres in the case of emergency flooding. “The whole structure is pretty bizarre.”

Mike Osborne – the CEO at ICM Business Continuity – also thinks the Government needs to co-ordinate its anti-terror efforts a little bit better than it has been doing of late. Osborne finds it difficult to see how CONTEST2 fits in with other policy responses and projects, among them the Civil Contingencies Act (of which more anon) and the famous Project Griffin.

Exactly what training is on the table?

At present, it’s pretty unclear as to exactly what training is proposed for the 60,000 individuals, or how they will be selected. David Lea, UK analyst at CRG, believes most of the people earmarked for training are facilities managers, security officers and managers in the retail arena.

“When you think of every business in the country, 60,000 people isn’t actually that many, is it?” said Lea. By comparison, there’s something approaching 250,000 individuals licensed to work in the UK security sector by the Security Industry Authority (SIA).

George Cook has no problem with the idea of ‘amateurs’ being employed. He points to American initiatives such as the Citizen Corps with its many affiliate organisations, and to the benefits of training. For instance, fire drills do help improve response in an emergency. “Even if the emergency isn’t a fire and the route followed is different, if you’ve been trained then you’re predisposed to be calmer. You do think more positively, and survival rates are going to be higher in that situation.”

However, Cook is also of the mindset that 60,000 people isn’t nearly enough. “It’s just a drop in the ocean.”

Mike Osborne told SMT Online that he feels the Government shouldn’t be delivering training on its own. “Instead,” suggested Osborne, “it would be better to work with organisations as a whole on this, so that counter-terrorism becomes a subset of standard business continuity and resilience training for all employees.”

Doing the maths: will the figures stack up?

Osborne put some meat on the bones of this assertion with a quick calculation. ICM Business Continuity estimates that there are between 6,000 and 7,000 organisations contracting-out their business continuity strategy to a designated third party solutions provider. “If you could encourage them to engage their employees,” said Osborne, “you’d very quickly reach well beyond 60,000 aware civilians.”

That would also be a highly cost-effective solution. Cook suggests another cheap option. “What would it cost for the Prime Minister to appear on television and designate an Emergency Preparedness Day? I’ll tell you. It would cost little or nothing, and it would be a hugely effective way to impart the message.”

Cook believes an obvious opportunity has been missed, although as David Lea pointed out, when the Government did try to involve the public – with the ‘Preparing for Emergencies’ document – it was castigated as scaremongering and a huge waste of the tax payers’ money.

Community Resilience is a good example of how organisations are already co-operating to combat terrorism. The organisation is engaged with 50 major companies, and at the same time talking to the Confederation of British Industry. Cook explained: “Many businesses are extending their idea of business continuity sideways to see what they can do to help the community around them.”

By way of an example, Sainsbury’s has authorised local managers to release stock off the shelves if it’s needed in a crisis situation. Many other firms are now pre-authorising staff to act in an emergency.

Nod to the Civil Contingencies Act

The Civil Contingencies Act, in fact, did quite a good job of pulling corporates into the emergency preparedness framework. That’s the firm belief of Ron Miller, managing consultant at SunGard Availability Services. “Making telecoms and power companies Category 2 Responders, with a responsibility to be resilient, recognised the part businesses need to play in emergency response.”

9/11 caught the world ill-prepared for major terrorist attacks. In the last decade, how far have we come, then, towards a situation where we are ready? “Preparedness is an awful lot better than it was,” explained David Lea. “The issue has certainly moved up the corporate agenda. Clients are coming to us looking to generate crisis response plans. As recently as four years ago, this kind of thing wasn’t even on their radar.”

However, Lea told SMT Online that responsibility still needs to be rolled out further – much further than the Home Office is proposing. “Key people are much better prepared,” he says, “but there are of course a lot of people who aren’t key people.”

In IT continuity the situation is broadly similar. Larger companies have cleaned up their act, particularly in the financial sector. The Government, too, has taken steps to improve its own data security after a series of embarrassing high profile data losses.

That said, according to Ron Miller there are still a lot of smaller companies which have single source critical infrastructure with no resilience at all. There are also companies which, while they protect core data, don’t recognise the importance of the currency of that data. Daily system back-ups are no longer enough in a world of e-commerce where a whole day’s orders could be lost if systems crash at five o’clock in the afternoon.

In short, there’s still a lot of work to be done.

Moving in the right corporate direction

As stated, the corporate world is moving in the right direction. As David Lea said: “The terrorist threat is not going away any time soon.” In the long term, that alone will create greater awareness of security issues. Lea notes that this is affecting every area of business. For instance, there’s an increasing culture of corporate anonymity, with firms choosing not to emblazon their names on the sides of buildings.

Lea stated in conversation with SMT Online that security management has changed, too, with far more realistic plans now in place and an increasing willingness to test crisis response plans. “The culture of security management has become more fluid and more proactive,” suggested Lea, although he quickly admits it has further to go.

Changes in technology are also affecting business continuity plans. For instance, widespread broadband adoption enables many companies to build working from home into their emergency plans. Ron Miller, though, warns against simplistic assumptions that remote working will automatically be possible.

Staff who have left their laptops in the office overnight may be unable to access the data they need. There are also problems with infrastructure – companies using VPN or Citrix portals for home workers may find they don’t have enough scale to cope, or that the connections aren’t as robust and reliable as they might be. “If you have 50 licences, and on a typical day 30-40 people use the portal, you’re going to have a real problem if all of a sudden there are 500 employees trying to log on.”

That’s before you take account of probable contention for a limited broadband network in residential areas.

Corporates taking their eye off the ball

Although emergency preparedness has improved over the past ten years, there is some anxiety that the current recession may take businesses’ eyes off the ball.

George Cook worries that the fight for financial survival may assume precedence over preparedness. “Businesses have put everything aside from staying afloat firmly on to the back burner, and you can understand why,” he said. “The financial crisis has distracted everybody, but we need to have our eye on the ball.”

Mike Osborne, too, worries that businesses are even more likely to focus on staying afloat rather than on business risk. He pointed out that unless they are directly impacted, businesses are always slow to change their policies in response to incidents.

The frustrating thing is that security doesn’t necessarily cost money – while continuity isn’t just about technological solutions. As Mike Osborne said: “A large part of security is cultural. It’s about awareness, and awareness is free.”

There’s a lot of free advice out there, in fact, and the greatest thing the Government could do to improve the potential civilian response to terrorist events – as well as to other emergencies – is help businesses in finding and using that advice to best effect.