Business & Technology
Environment
Summer 2010
Robert G Parker
S-1
© RGP & UW-CISA 2010
Business & Technology
Environment
Summer 2010
Robert G Parker
S-2
© RGP & UW-CISA 2010
Agenda
Crisis Management
Privacy
Social Networks
eDiscovery / eEvidence
Cloud Computing
Parallel Programming
S-3
© RGP & UW-CISA 2010
Crisis Management
S-4
© RGP & UW-CISA 2010
Crisis Management
December 3, 1984
The Incident, Response, and Settlement
Initially 3,800 dead.
Subsequent deaths have
raised the estimates to 25,000
In the early hours of December 3, 1984, methyl
isocyanate (MIC) gas leaked from the Union Carbide
India Limited (UCIL) plant in Bhopal, India. According
to the state government of Madhya Pradesh,
approximately 3,800 people died and several thousand
other individuals experienced permanent or partial
disabilities.
Union Carbide’s initial
response was denial, quickly
followed by aid and
assistance
The court case:
In February 1989, the
Supreme Court of India
directed a final settlement of
all Bhopal litigation in the
amount of $470 million. The
Government of India, UCC
and UCIL accepted the
Court’s direction.
S-5
Shortly after the gas release, Union Carbide launched
an intensive effort to identify the cause. An initial
investigation by Union Carbide experts showed that a
large volume of water had apparently been introduced
into the MIC tank and caused a chemical reaction that
forced the chemical release valve to open and allowed
the gas to leak. A committee of experts, working on
behalf of the Indian government, conducted its own
investigation and reached the same conclusion. An
independent investigation by the engineering
consulting firm Arthur D. Little determined that the
water could only have been deliberately introduced into
the tank, since safety systems were in place and
operational that would have prevented water from
entering the tank by accident.
© RGP & UW-CISA 2010
Crisis Management
In the days, months and years following the disaster, Union Carbide took the
following actions to provide continuing aid:
• Immediately provided approximately $2 million in aid to the Prime Minister’s Relief Fund;
• Immediately and continuously provided medical equipment and supplies;
• Sent an international team of medical experts to Bhopal to provide expertise and
assistance;
• Openly shared all its information on methylisocyanate (MIC) with the Government of India,
including all published and unpublished toxicity studies available at the time;
• Dispatched a team of technical MIC experts to Bhopal on the day after the tragedy, which
carried MIC studies that were widely shared with medical and scientific personnel in Bhopal;
• Funded the attendance by Indian medical experts at special meetings on research and
treatment for victims;
• Provided a $2.2 million grant to Arizona State University to establish a vocational-technical
center in Bhopal, which was constructed and opened, but was later closed and leveled by
the government;
• Offered an initial $10 million to build a hospital in Bhopal; the offer was declined;
• Provided an additional $5 million to the Indian Red Cross;
• Established an independent charitable trust for a Bhopal hospital and provided initial
funding of approximately $20 million, and
• Upon the sale of its interest in UCIL, and pursuant to a court order, provided approximately
$90 million to the charitable trust for the hospital
S-6
© RGP & UW-CISA 2010
Crisis Management
Ten days after the decision, UCC and UCIL made full payment of the $470
million to the Indian government.
The settlement award was much larger than any previous damage award in
India, and was $120 million more than plaintiffs’ lawyers had told U.S. courts
was fair. In directing the settlement, the Supreme Court of India reviewed all
U.S. and Indian court filings, applicable law and relevant facts, and an
assessment of the victims’ needs. In its opinion, the Court said that
compensation levels under the settlement were far greater than would
normally be payable under Indian law.
By November 1990, the Reserve Bank of India reported that the settlement
fund, with interest, was approximately twice what was estimated to be
needed to compensate the victims.
To resolve continuing legal disputes, the Supreme Court of India in 1991
affirmed the settlement; described it as “just, equitable and reasonable,”
and dismissed all outstanding petitions seeking review of the settlement.
Pursuant to the settlement, the Government of India assumed responsibility
for disbursing funds from the settlement.
S-7
© RGP & UW-CISA 2010
Crisis Management
The Case Drags On
An India media report in September 2006 stated that the "registrar in the
office of Welfare Commissioner... said all cases of initial compensation
claims by victims of the 1984 Bhopal gas tragedy have been cleared… With
the clearance of initial compensation claims and revision petitions, no case
is pending…"
2010
Concerns are being raised in India over the amount of the
settlement ($470 million), given that British Petroleum have already
set aside a $ 20 Billion fund for clean-up.
Only 11 lives were lost, all oil rig workers, compared with 3,800
civilians in Bhopal, and climbing towards 25,000.
S-8
© RGP & UW-CISA 2010
Crisis Management
2010
Seven former senior employees of
Union carbide convicted for their
role in the 1984 leak
Sentenced to two year terms in
prison
Victims protest the light sentences
“More than 25 years later
thousands of children are
born with brain damage,
missing palates and twisted
limbs because of their
parents exposure to the gas
Source-Globe & Mail June 8, 2010
S-9
© RGP & UW-CISA 2010
Crisis Management
BP oil spill costs soar above $3B
Agence France-Presse
First Posted 06:31:00 07/06/2010
Filed Under: Environmental pollution, Disasters & Accidents, Oil & Gas - Upstream activities
NEW ORLEANS—BP's costs over the Gulf of Mexico oil spill soared Monday above $3 billion, while a
giant Taiwanese ship provided hope of revolutionizing on-sea skimming operations.
"The cost of the response to date amounts to approximately $3.12 billion, including the cost of the
spill response, containment, relief well drilling, grants to the Gulf states, claims paid, and federal
costs," BP said.
The latest estimate is far higher than the $2.65 billion given by the energy firm one week ago.
BP's share price has collapsed more than 50 percent since the Deepwater Horizon oil rig it leased sank
on April 22, two days after a blast that killed 11 workers.
After intense pressure from President Barack Obama over the worst ever US environmental disaster,
BP agreed last month to suspend its shareholder dividend and create a $20-billion fund for costs
arising from the spill.
BP is also selling non-core assets to raise $10 billion, while international ratings agencies have
downgraded the company's credit worthiness.
S-10
Source: Inquirer.net – July 6, 2010
© RGP & UW-CISA 2010
Crisis Management
What Happened in the 25 Years In Between Bhopal and BP?
Chicago Tylenol murders
The Chicago Tylenol murders occurred when seven people died after taking
pain-relief capsules that had been poisoned. The Tylenol poisonings, codenamed TYMURS by the FBI, took place in the autumn of 1982 in the Chicago
area of the United States. These poisonings involved Extra-Strength Tylenol
medicine capsules which had been laced with potassium cyanide.[1] The
incident led to reforms in the packaging of over-the-counter substances and
to federal anti-tampering laws. The case remains unsolved and no suspects
have been charged. A $100,000 reward, offered by Johnson & Johnson for the
capture and conviction of the "Tylenol Killer," has never been claimed.
Aftermath
The media gave Johnson & Johnson much positive coverage for its handling
of the crisis; for example, an article in the Washington Post said, "Johnson &
Johnson has effectively demonstrated how a major business ought to handle
a disaster."
S-11
© RGP & UW-CISA 2010
Crisis Management
Aftermath
The article further stated that "this is no Three Mile Island accident in which
the company's response did more damage than the original incident," and
applauded the company for being honest with the public.
In addition to issuing the recall, Johnson & Johnson established relations
with the Chicago Police, the FBI, and the Food and Drug Administration. This
way the company could have a part in searching for the person who laced
the Tylenol capsules and they could help prevent further tamperings.[8]
While at the time of the scare the market share of Tylenol collapsed from 35%
to 8%, it rebounded in less than a year, a move credited to J&J's prompt and
aggressive reaction.
In November, it reintroduced capsules but in a new, triple-sealed package,
coupled with heavy price promotions and within several years, Tylenol had
become the most popular over-the-counter analgesic in the US.
S-12
© RGP & UW-CISA 2010
Crisis Management
Tylenol became the new high-water mark in crisis management
There followed a series of events that created crisis management
procedures and best practices:
Pepsi – Followed Tylenol’s example - grocery store caught customer
tampering with soda bottles
Ford – Initially indicated that they made the cars, not the tires, but
quickly offered to replace the tires on any of the SUVs susceptible to
roll-overs with any tires the customer wanted. (Consider Ford’s
ranking amongst the Detroit 3 today!)
Toyota – Floor mats, accelerator, congressional hearings and denials.
There were other examples, some followed best practices and others didn’t. The
marketplace remembers.
S-13
© RGP & UW-CISA 2010
Crisis Management
Planning and Preparation
Incident Identification
Incident Stabilization and Containment
Incident Remediation
Incident Recovery
Event Monitoring and Reporting
S-14
Incident Communication
Six Steps of Event/Crisis Management
© RGP & UW-CISA 2010
Crisis Management
What Happened With British Petroleum?
Planning and Preparation
Limited emergency equipment on
hand
Had to design, build and test
potential solutions
Delays measured in weeks and
months
In effective communications plans
Denial:
It wasn’t our drilling platform we
hired it complete with crew, etc
It is only a small leak 5,000 bbls
per day
S-15
Source USA Today – June 6, 2010
© RGP & UW-CISA 2010
Crisis Management
Incident Identification
They knew they has a potential
disaster
Their identification of the event
was based response on poor
and unrealistically low
estimated
They failed to understand the
enormity and complexity of the
challenge in situations where
the blow-out protector failed in
deep water
S-16
© RGP & UW-CISA 2010
Crisis Management
What Happened With British Petroleum?
Incident Stabilization and Containment
Successive failures to
cap the well
Inability to stop the flow
Inability to capture
leaking oil at the source
Employment of dispersal
rather than capture –
Likely exacerbated the
situation
The situation was neither stabilized or contained
S-17
© RGP & UW-CISA 2010
Crisis Management
What Happened With British Petroleum?
Incident Remediation
Remediation deals with
repairing or changing the
cause in order to eliminate
the cause of the “event”
Criticism of the efforts of BP
BP failed to achieve any of
their goals in the estimated
times
Initial response was to break
the oil up
A solution is still not in sight;
response consists of larger
clean up ships
S-18
© RGP & UW-CISA 2010
Crisis Management
What Happened With British Petroleum?
Incident Recovery
They based response on poor
and unrealistically low
estimated
Until the cause of the
incident is remedied the
recovery (returning to pre
event processes) tasks
cannot begin
Every critical date has been
missed
S-19
© RGP & UW-CISA 2010
Crisis Management
What Happened With British Petroleum?
Event Monitoring and Reporting
Reporting has been relentless
but the reports do not shed light
on the solution, simply the
problems and failures
Moral High-ground
S-20
© RGP & UW-CISA 2010
Crisis Management
What Happened With British Petroleum?
Crisis Communications
Internal – key incident response teams and all employees
External – clear, do not mislead, single authoritative source, targeted
Legal/Regulatory – meet legal requirements, meet public expectations
Transparency – sufficient information to explain the situation and its
impact on businesses & individuals, particularly personal information
Best Practices – additional items, PI breaches = credit monitoring
Pre-scripted Messages – respond in a reasonable period of time
Monitor Promised Activities – progress & effective action
S-21
© RGP & UW-CISA 2010
Crisis Management
What Happened With British Petroleum?
Crisis Communications
April 20, 2010 – July 11, 2010 = 82 days
Don’t go off script – “I want my life back”
S-22
© RGP & UW-CISA 2010
Crisis Management
Issues
Few business have
enterprise risk
management programs
Few business have
comprehensive,
enterprise-wide,
Business Continuity
Plans
IT Disaster Recovery
Plans are, to varying
degrees, being
addressed
Crisis communications
require attention
S-23
Security
Disaster Recovery / Business Continuity
Katrina highlights DR need
By: Warren Lee
IT World Canada (16 Sep 2005)
Hurricane Katrina made every IT organization question the viability of its
disaster recovery (DR) plan. A natural disaster, a major accident or a terrorist
act in the headlines forces us to think about survival. Could your facility, or your
business, take a hit like that and survive?
At such times, many businesses resolve to ensure that their data assets are
protected. Yet in the years since 9/11, the 2003 blackout, the Quebec ice
storm and Hurricane Andrew, there has been little real change in the way
businesses manage these sorts of risks. While spending on disaster
recovery and business continuity (BC) activities has risen, such increases
are gradual and do not reflect the attention spikes that follow disasters.
A year after the 2003 blackout that left a large swath of North America’s
industrial heartland without electricity for several days, the Leger Group
surveyed 300 Ontario business leaders about their business continuity plans.
They found that only 30 per cent have a full-blown business continuity
plan, while another 32 per cent claim to have an informal plan; 28 per cent had
no plan at all.
© RGP & UW-CISA 2010
Crisis Management
Opportunities
Increased guidance and direction on incident
management and crisis communications
Service offerings including period reviews/assessments
of an entity’s crisis preparedness
Increased focus on enterprise risk management from a
shareholder/stakeholder perspective
Increased attention to business continuity issues,
including supply chain and reliance on others
We have to do a Better Job of Enterprise Risk Management
S-24
© RGP & UW-CISA 2010