​

IF ONE HAD TO SUM UP the Katrina response in one sentence, it might be this: neither the multiple governments involved nor most of the many private companies affected had adequate plans in place to deal with the disaster—but once the magnitude of the crisis became clear, private industry was much more nimble in reacting to the situation, both in helping employees and in dealing with asset protection and business continuity.

People First

It’s only natural that much of the early media attention centered on the thousands of stranded people in New Orleans who weren’t getting timely help from the authorities. Many others, however, were getting a great deal of immediate and extensive assistance—not from government, but from their employers, who really did put their people first.

“First and foremost, in a disaster situation, you have to make sure your people are safe, and then you have to protect your property,” says Lawrence K. Berenson, CPP, security director of L-3 Government Services, Inc.

That was consistently the message from businesses that spoke with Security Management about their response to Katrina. Achieving either objective was easier said than done, however.

Marriott International, Inc., had 15 hotels in the New Orleans area—11 downtown were affected, with flooding in three of the locations. When the flooding began, 2,300 guests and employees were still in those facilities, says Chad Callaghan, CPP, vice president of enterprise loss prevention at the company.

Through the efforts of one of his regional loss prevention directors, and with some advanced planning, they were able to get buses and a state police escort to evacuate those people within 48 hours.

That was only the beginning of the company’s efforts on behalf of employees. J.W. (Bill) Marriott “quickly made a decision that we were going to set up a center in Houston,” says Callaghan. From there, staff would try to locate displaced employees and help them find housing and alternative employment. Marriott also decided that employees would be paid through September.

Other companies took similar steps. In the immediate aftermath, “we set up a number of employee hotlines for companies so that their employees could call in,” says Bruce McIndoe, chair and CEO of iJet, an enterprise risk management and crisis response service provider. “We would check people off, get their health status, understand what their needs were, where they were, and did they know about other employees.”

McIndoe notes that most companies didn’t have any structure set up for handling these issues before Katrina struck. “They were kind of reacting to it in real time,” he notes. But “all of those clients are now looking to institute those [hot]lines permanently so that they have them in an emergency and don’t have to scramble again.”

Similarly, many clients are now talking with him about setting up permanent backup emergency communication systems, such as with satellite phones, to ensure that next time they will have communications with key staff in locations where phone services go down.

iJet worked with about 20 companies in the area, ranging from chemical plants and grain elevator and storage facilities to banks and medical service providers. McIndoe notes that, like Marriott, the companies he worked with “have been very good about continuing to pay salaries to all employees even though operations shut down.”

The story was the same among security service providers—struggling simultaneously with their own employees’ hardships and increased demands from clients in the area. AlliedBarton, for example, which had about 100 employees in Louisiana—55 in New Orleans—arranged to pay employees whether they could work or not for several weeks after the disaster.

“In the case of the officers that were displaced, if they did not identify or locate housing in a timely fashion, we provided housing for them, and we provided continued employment out of Baton Rouge,” says Mark Porterfield, vice president and general manager of government services for AlliedBarton. “For those relocated out of state, we have made every effort to reach out to them to make sure they received their pay and to employ them in those states.”

Johnson Controls, which had 350 employees in the affected area, took similar steps. The company set up a toll-free phone line that employees could use to check in and share information. In addition, it made a $1 million contribution to the American Red Cross and set up a way for coworkers to donate to a fund or contribute items through a Web site where they could match needs of those affected.

And when the company realized that replacement housing was impossible to find, “we bought RVs in Wisconsin and immediately started shipping them down to the campgrounds” for employees, says Eric Reisner, vice president of strategic programs and point man on Katrina response for Johnson Controls.

Of course, the efforts to help employees—though generous by any measure—were not entirely altruistic. Companies needed staff to get their operations up and running. That need has also led to some interesting service provision opportunities for businesses. For example, Johnson Controls has found that companies in many of the vertical markets that it serves, such as healthcare and schools, now need basic support services for employees that cross over these markets.

For example, a university wanted to know how to set up a charter school for its employees, and a hospital wanted to offer daycare for staff because otherwise they wouldn’t return to work before such services became available generally in the area. “We can help with that. We’re actually kind of a matchmaker between our vertical markets now,” says Reisner.

Similarly, IT departments at some of the companies that iJet was working with were trying to figure out if they could set up remote work centers in Baton Rouge or another nearby area, says McIndoe. They are just looking for any way possible to get employees “back contributing to the company.”

Self-Sufficiency

One important lesson cited by those interviewed is the need for a company to be prepared to fend for itself in the early days of such a severe crisis. They should be able to handle evacuation, asset protection, and recovery efforts with little or no help from the government.

“You can’t count on the authorities,” says Callaghan. “If your plan has primary response by the authorities, you’d better have a backup plan,” he says.

Callaghan learned that the hard way in the aftermath of Katrina. “I was very surprised,” Callaghan says. “I really had great expectations that the state and federal and local governments had procedures in place to deal with this, and we quickly learned that we were on our own.”

Marriott turned to private security, as did many other companies. The absence of government support meant that “there was a lot of scrambling for private security,” Callaghan notes.

Berenson, whose company is a government contractor that had personnel at a government-owned shipyard repair facility in the area, typically has had private guard services come in to protect the property in different crises. But, he says, that was difficult in this situation.

Part of the problem was red tape. Since local guard service providers were devastated, businesses needed guards from outside of the area, but they weren’t licensed in the states affected, explains Bill Alford, president of International Lighthouse Group, Charlotte, North Carolina.

And getting through the bureaucratic maze was impossible. “I called DHS, FEMA, everyone,” says Alford. They told him, “We’ll try to get back with you sometime in the middle of next week.”

In the end, he says, one out-of-state guard service provider from New York simply decided to deploy personnel. They did clear it with their attorneys and insurer, says Alford, and they said, “we’re going for it.”

The situation was different for The Steele Foundation, a high-end contract security company with a rapid-response focus, which provided guards and other services to Marriott and other large companies, including Wells Fargo, MCI, British Petroleum, and Best Buy.

Because rapid response in emergencies is their business, they knew how to get the requisite permission. As the company was sending personnel in after the storm, “we had contacted the board of licensing of Louisiana, and they issued a broad declaration of reciprocity” for companies licensed in states with which Louisiana had agreements, says CEO Kenn Kurtz.

In addition to providing thousands of meals and bottles of water for businesses whose personnel needed supplies, Kurtz’s private force helped with search and rescue, evacuating over 2,500 people from the area. They also assisted in asset recovery, such as the relocation of one of the largest art collections in the southeast from a facility that was half-flooded, notes Kurtz.

AlliedBarton says that its officers were primarily asked to provide physical security at facilities. They also helped companies make a record of damages by taking pictures of property, and they helped with retrieval of assets by going in to affected facilities to retrieve important documents and valuables.

No Infrastructure

The complete devastation of the infrastructure in New Orleans made every task difficult. Initially, a major problem at each company’s corporate headquarters was that it was “very difficult just getting the facts, so that they understood the impact on the business and people and ... what resources they needed to muster to support their business,” notes McIndoe.

Moreover, notes Johnson Control’s Reisner, “this was the first time where the infrastructure of our people was also totally taken out,” which meant that employees had no homes to go to in many cases, could not communicate with anyone, and could not reach the office.

iJet worked to get critical information to companies through satellite imagery of the locations. Such images would show what was underwater and what hazardous conditions might be encountered if company personnel were sent to the site. But even that was not possible immediately. “We were hindered by cloud cover and the scheduling of satellites,” McIndoe explains.

After assessment came recovery. Though companies did not typically have hot sites to transfer to, they adapted. Johnson Controls dealt with the absence of local systems by setting up emergency operations out of Dallas. It routed computers through servers there to take over for servers no longer working in New Orleans. It also reissued cell phones with working area codes to employees, rerouted e-mails, and basically routed its entire digital infrastructure around the Gulf area, says Reisner.

Even a company as prepared for crises as The Steele Foundation found the absence of any working infrastructure a daunting challenge, however. Like many others, it had to find a way to house employees who came to do the rescue and protection work. Though the company was able to bring in some RVs, “lots of our people slept in tents and makeshift camps for almost five days,” says Kurtz.

The company used watercraft and aircraft to get around and delivered satellite phones to clients to make up for the lack of any communication infrastructure. In the future, says Kurtz, they plan to ramp up supplies of certain types of infrastructure needs, such as generators, to help both themselves and their clients be even more self-sufficient.

In that regard, it’s also worth noting that it matters where companies locate emergency generators. When the waters came, some facilities instantly lost their backup generators, because they were in basements that flooded. The same was true of other critical data and telecommunications systems. Designing with security in mind can minimize that risk.

Ken Brady, CPP, vice president of operations at Crisis Management Associates, refers to a university client of his who was right in the hurricane path. The facility originally had all of its main systems in the basement of an old building.

“This was below sea level. On a good day, the building leaked. On a bad day, it would never keep up. I asked, ‘What if the levees were to break and that basement was flooded? You would immediately lose your power, telecommunications, head end.’ Happily, they decided this was an unacceptable risk.”

At the time, they were building a new gymnasium. The new building would have concrete reinforced walls, with information technology and all other related equipment located in a specially hardened area.

“The building was engineered so that it is 20-feet up on concrete pilings, basically on concrete stilts,” says Brady. “The building can house 1,500 to 2,000 people, so I suggested, why not make this a designated storm shelter in case of a hurricane? This is what they did. They were concerned about the possibility of a hurricane, so invested in the security of the people and the structure.”

No one is questioning the wisdom of that investment today.

Taking Charge

All the resources in the world won’t help if decision-makers don’t take charge of the response and see that those resources are properly deployed. That took too long during Katrina, says McIndoe.

The problem was the way that companies and governments handled the decision-making process between central and local offices. Traditionally, the local crisis management team has autonomy to deal with what’s on the ground, and the corporate team’s mentality is to be a resource provider, says McIndoe. The federal government took the same approach.

In both cases, decision-makers located in the head office waited for people on the ground to tell them what they needed. But local crisis management teams were overwhelmed by the magnitude of what they faced, notes McIndoe.

“Every company now and the feds are going to have to reassess this,” he says, adding that there need to be some trigger points to signal when top brass knows “we’ve just got to take charge.”

Sherry L. Harowitz is editor-in-chief. Freelancer Thomas G. Dolan contributed to this report.