Disaster Recovery: Hoping for the Best, Planning for the Worst
By Sarah Kellogg

Watching Hurricane Katrina rip apart Gulf Coast homes and businesses in Alabama, Louisiana, and Mississippi last September was a chilling and not-so-gentle reminder that Mother Nature plays no favorites. That a hurricane could also wreak havoc in the lives of those in its path was not surprising, and those outside the hurricane’s reach were thankful that fate had not placed them there, as those untouched by disaster always are.

New Orleans was especially hit hard. A breach in a levee forced an entire city to retreat as block after block disappeared from view, taking with it New Orleans’s prized homes, colorful history, and much of its business community. Shock turned to horror and despair, leaving many wondering how the city’s residents and businesses would survive.

For the law firms that called and still call New Orleans home, the first priority was protecting their employees. Fleeing to higher ground meant transplanting their people and offices to Baton Rouge, Shreveport, or Houston. As waters receded in the weeks that followed, the next goal was to figure out how to restart their businesses, often without staff, offices, or even clients.

Many New Orleans firms had no disaster plans to weather a major emergency, and if they did, the plans weren’t designed for a citywide calamity in which flooding, power outages, and food shortages would turn an international tourist mecca into a literal backwater.

If the events of September 11, 2001, had taught Washington law firm leaders about the importance of preparing their offices for a major disaster such as a terrorist attack, Hurricane Katrina pounded the message home, adding the all-too-familiar reminder that no U.S. city is immune from catastrophe.

“New Orleans is a very instructive example,” says John Copenhaver, an attorney and president and chief executive officer of DRI International, a Washington-based organization that focuses on business continuity education and professional certification. “It is a worst-case scenario in many ways. There were law firms that were literally flooded out, and the attorneys couldn’t get to their offices—not just for days, but for weeks and months.”

In the wake of Katrina, disaster planning experts say if Washington law firms haven’t crafted disaster plans, they need to now, no matter the size of the firm. If they have disaster or business continuity plans, they need to dust them off to make sure they take into account advances in technology and the latest threats, such as avian flu.

Law firms cannot afford to be complacent in protecting their people, assets, and clients, top disaster professionals say, because Washington is in line for a life-altering, business-changing disaster in the not-too-distant future. It is not a question of if it will happen but, rather, when.

“Certainly for man-made disasters we’re as prime a target there is outside of New York,” says Barry Scanlon, senior vice president and partner with James Lee Witt Associates, LLC, a Washington disaster planning firm that works with public agencies and private companies around the country to assess threats and develop preparedness strategies. “For natural disasters, we’ve had events that have touched D.C. but never really overtaken it. Evidence and recent history suggest that it is going to happen. Anyone who thinks it’s not is burying his head in the sand.”

Preparing for an unforeseeable catastrophe may be daunting, but it is not impossible. Certainly, developing a strategy for the explosion of a dirty bomb—a possible practice-ending threat—requires a different level of planning and preparation than ensuring you’re on guard for an office fire or a nasty computer virus. But both demand an effective and timely response.

Although disaster planning may not be at the top of the agenda for most firms, business continuity probably is. Think of them as flip sides of the same coin, the experts say. Business continuity, like disaster planning, is no more than considering the likelihood of potential problems and then developing contingencies to ensure the smooth operation of the law firm if they occur.

For firms large and small, what this kind of planning begins with is a commitment from stakeholders that expending time and money on disaster preparation and business continuity planning is an investment in the long-term viability of the law firm. After all, firms not only want to survive a crisis like Katrina, they want to thrive after it recedes into memory.

No Law Firm Is an Island
It’s unlikely Washington will be hit with a catastrophic natural disaster like the one that struck New Orleans. Hurricanes rarely reach the city. Washington may be below sea level, but an overflowing Potomac River has yet to breach upper K Street. And earthquakes are about as likely as snow in July.

But Washington isn’t so lucky when it comes to laying odds on a man-made disaster, especially acts of terrorism. The city remains a potential ground zero despite the massive security buildup that followed September 11.

Though optimists have long felt that Washington dodged a bullet and that the likelihood of another terrorist attack is remote, experts say that disasters are indiscriminate. Without warning, they can strike the region, city, neighborhood, or even the building where a law firm is located.

That knowledge begs the question: What kind of natural or man-made disaster would send your firm into retreat? Consider these scenarios:

A dirty bomb makes downtown Washington a virtual ghost town for months, if not years, to come.

A pandemic or avian flu outbreak requires the quarantine of tens of thousands of residents and results in thousands of deaths.

An electric transmission station melts down, shorting out the power grid and leaving much of the mid-Atlantic in the dark.

An explosion along K Street rips apart a Metro station, killing hundreds of people and leaving a gaping hole in the city’s infrastructure.

A disgruntled former employee sends what appears to be an anthrax-laced letter to your offices.

Implausible? Perhaps. But don’t dismiss this laundry list of potential disasters and threats as more the-sky-is-falling paranoia. These doomsday scenes are all part and parcel of the disaster planning process, whether they be imminent or a one-in-a-million chance.

“Even though intellectually we can say . . . we could potentially be impacted by a terrorist attack or a severe winter storm or an ice storm, knowing emotionally we need to be prepared for something like that is harder,” says Copenhaver. “That’s taking it to the next step. I don’t know if all law firms are ready for that.”

If there isn’t a major disaster in the office or in the region, a localized threat of any kind can interrupt business and prevent a firm from getting on with its work. In a town like Washington, with so much activity and so many law enforcement agencies controlling access to specific streets and neighborhoods, the opportunity for schedule-changing events are many.

This example may sound familiar. Suppose the police close 10 blocks of downtown Washington because a man is sitting on a tractor threatening to kill himself at the Ellipse, south of the White House, one busy Tuesday morning? How can you respond? No matter how frustrating, nobody is allowed in or out of the perimeter, regardless of whether an important client meeting is scheduled that morning.

“There are hundreds of events that could happen in a hundred different places and ways in this city,” says James Leary, executive director of Akin Gump Strauss Hauer & Feld LLP. “If a water main breaks and floods our offices, we have a relationship with three other law firms that would allow us to use their offices so key meetings can go on. You can’t have an action plan for every single one of these kinds of events. What you can do is put into place contingencies that could work in any number of situations.”

Taking Inventory
The first step to putting those contingencies into place is deciding who will be at the table to write a new disaster plan or rewrite an old one. Though there may be some resistance to losing billable hours, the wider the group of decision makers, the better off the law firm.

Edward Poll, a Los Angeles attorney and the principal of LawBiz Management, a national legal consulting firm, says it’s important that both the administrative and legal sides of the firm be present for these discussions. “You need to create a committee of the important powers within the firm. That means the managing partner, one or two people from the management committee, the executive director, the chief operating officer. These are the folks who can make the important decisions. These are the folks who are the stakeholders for your success.”

As for smaller firms, it’s important that they, too, try to include the widest range of company representatives as they prepare a plan. Since there is likely to be much overlap in the work handled by administrative staff, disaster planning professionals recommend that everyone be included in this early stage.

And for solo practitioners, the conversation may go beyond office walls to include consultants or part-time staff, such as a bookkeeper or computer tech, who play key roles in facilitating operations.

But the degree of representation at the table is most significant for Washington’s larger firms, and the management committee will have to decide how broadly to seek consensus on disaster planning and business continuity strategies, say the experts.

“For very large firms that have multiple practice areas, you have a top-flight representative from each area,” says Poll. “Since they are, in effect, their own law firms, if they perceive something they don’t like in the plan, something that goes against their grain, they will make sure that it fails if they’re not consulted.

“Every stakeholder who can sabotage your project, every stakeholder who can support and implement your project, must be at the table. In addition, every element of your law practice that you want to continue after a disaster strikes should be there: human resources, finances, and technology.”

With the stakeholders gathered, the next step is to conduct an assessment of the firm’s readiness. Ask the most pertinent questions. What is already in place? Where has the firm excelled? Are there any weaknesses?

At the same time, the group will need to review the potential threats and the consequences of those threats. What should the firm do to protect itself against a building fire or faulty sprinklers? What should it do to prepare for a citywide event?

Any analysis should include a review of the firm’s significant business relationships, whether they are with insurance companies, vendors, or banks. These conversations lay the foundation for any top-notch disaster plan.

For example, by reviewing insurance coverage ahead of time, firm leaders will have a better understanding of what they need to do when filing claims and how long it might take to receive a check after a disaster. Or an anticipatory conversation with the firm’s banks will make it easier when seeking a line of credit or loan after an emergency.

And what’s more important than finding out ahead of time what contingencies have been put into place by the building landlord for catastrophic events? When the power fails, can the firm count on the landlord to have generators as a backup?

As with most business plans, the devil is in the details. That’s why it is key that the firm create a comprehensive disaster recovery manual. Consider it a business continuity bible, breaking down all the elements of any recovery plan and addressing the central considerations for any firm: employees, the office, information, and outside relationships.

This bible should be both broad and deep, outlining which staff members will be tapped to serve as team leaders in emergencies and what next steps will be put into place to keep the firm running in the days and weeks after the event. Whose responsibility should it be to contact clients? Who knows where the case files are located? What priorities should be set to determine what gets fixed first when the technicians arrive?

And though it’s difficult to discuss, the disaster recovery plan should also include a section laying out the line of succession for the firm. If a disaster results in the sidelining of the managing partner or other members of the management committee through death or disability, then it’s important for continuity purposes that these lines of succession be clearly laid out before the event.

“What you end up doing is asking yourself what the risks are and how you can manage them. It doesn’t make a difference how big or how small,” says Dennis Kennedy, a St. Louis technology attorney and a national expert in the use of technology and the Internet in law offices. “You don’t need to cover all of the risks, but you do need to be realistic about them—what has a good chance of happening versus what probably won’t ever happen. It’s managing risk, and it’s something attorneys know how to do.”

All Hands on Deck
As the disaster-prep team builds its recovery manual, the most important section of the document will be the section addressing the concerns and needs of the firm’s employees. They are the lifeblood of any operation, and an emergency of any magnitude can have a dramatic impact on their lives.

What most major disasters teach the experts is that communication is paramount when complications large and small interrupt work for employees. If an attorney, paralegal, or administrative assistant is in the dark, the firm will suffer.

Staff need to know the rules of the game ahead of time. That means putting into place a solid training program (fire drills and the like) and providing frequent and updated communications to the staff about what to do when a disaster strikes.

Developing communication plans that can work quickly and effectively during a crisis is essential. They can be as traditional as a telephone tree or as complex as Voice over Internet Protocol, or VoIP, telephone services on the Web. But they cannot be too dependent on one kind of technology, experts say. Cell phones, though ubiquitous and always useful, proved less than reliable in both New Orleans and New York as cell towers crumpled in the flood and cell systems were overloaded after the World Trade Center collapsed. That means other devices that can work for short distances and in stairwells, such as walkie-talkies, must be purchased and disseminated.

For those employees who are home when a crisis strikes or who are sent home to work, most experts say the Web provides a useful tool for short- and long-term emergency needs. Some firms have established 800-number hotlines for employees to call, whereas others are using Web help desks to communicate information in crises.

“We have a customized help desk in Maryland that is managed by a third party,” says Terry Wiley, the firmwide executive director for Womble Carlyle Sandridge & Rice, PLLC. “Our employees can get into it no matter what. We can post messages on the front of that when we have major system outages in Washington or when there’s a problem. Our employees know that they can go to the Web and find out what’s happening there.”

One of the other lessons of September 11 was the importance of creating detailed emergency evacuation plans for offices and buildings. These plans appoint office or floor leaders to guide evacuations, and they include a process for keeping an accurate count of employees so firefighters and rescue workers know who’s at work and who isn’t. The evacuation plan also establishes a nearby or remote destination at which employees can meet if the law firm’s offices are closed down in an emergency.

“Having a good disaster plan, and having it managed well and practiced, is important,” says Scanlon. “You don’t want your employees spending too many hours evacuating the building. It’s not just the danger involved. It’s important to do if for no other reason than employees aren’t billing anyone if they’re standing out on the street corner.”

Physical safety may be a top priority, yet law firm leaders cannot ignore the emotional impact of a disaster. Many firms have lined up mental health professionals to help ease the emotional burden of losing colleagues in a fire or seeing a home destroyed by a tornado. When a crisis comes, it’s essential that the firm be a partner in assisting employees through all aspects of the emergency, experts say.

Employees may also need help in negotiating the basics of finding shelter and taking care of their children. Without a good night’s sleep and the knowledge that their children are safe, they won’t be able to get back to the firm’s business. Many law firms have hired consultants to find living spaces for employees during emergencies, or have helped employees find day care for their children.

And finally, it’s key that the recovery manual also take into consideration the financial effects of the disaster on employees. Though partners may be able to absorb a financial hit for several weeks or months, it’s unlikely that administrative staff will be able to handle too many weeks without a paycheck. It’s important to establish an employee assistance program to provide financial aid or bridge loans during a crisis.

Relocation
The disaster has struck. The roof and walls are damaged, if not gone. The power is out. Employees are fanning out to their homes or hotels. The physical space that defined the firm no longer exists.

Disaster professionals say this isn’t the moment for law firm leaders to start looking around for a good rental.

After a crisis, any effort to shift the law firm’s activities will be smoother if firm managers have outlined relocation plans in the disaster recovery manual. As the planning group looks at relocation, it’s important to remember that new space will determine, in part, the success of the firm.

Large, multi-office firms in Washington can take advantage of branch offices in other parts of the region or in other states, practically setting up shop within hours of a disaster and barely missing a beat.

Single-branch firms with financial resources may be able to shift their work to a mirror office where communications systems and computers duplicate those of the primary office. It’s important that these duplicate shops—located a good distance from the disaster—have telephone service, access to the firm library, and mail delivery.

For small firms or solo practitioners, the best option might be a trip home. Most lawyers and other legal professionals are tech-friendly enough to have up-to-date computers and high-speed Internet access and cell phones, allowing them to continue much of their work without interruption.

Now that the firm has a place to call home, has the emergency team ensured that the most fundamental elements of the work can continue for hours, days, or weeks? Remember to keep things simple. It’s not only the high-tech computer system that makes the firm run smoothly, but also having the most basic information, such as an up-to-date list of employee home and cell telephone numbers and e-mail addresses.

After spending months preparing a disaster plan, does anybody have a copy of it? That’s the last thing any disaster coordinator wants to hear from fellow employees. When traveling off-site, it’s important to bring along the plan. But don’t forget important office documents that tend to get lost in any evacuation. Those include building management phone numbers, vendor contact lists, petty cash, copies of insurance policies and the office lease, and, of course, client contact information.

Data Protection
If employees are the engine of the law firm, then the information that passes between them and the clients is the fuel. It’s a fuel that no one can afford to leave unguarded. These days, with the growing dominance of electronic records, keeping track of documents is becoming easier than ever, but it’s not foolproof. As work continues on the recovery manual, the law firm’s disaster planning committee needs to be diligent in generating a strategy to protect the firm’s most vital documents.

“Every law firm has records that are critical to the operations of that firm,” says Copenhaver. “How those records are stored, whether or not there are duplicates maintained, both paper and electronic, is a very important issue for the firm. You have to give some thought to this because so much of the firm’s work depends on these records, but you also shouldn’t be trying to literally make duplicate copies of the Library of Congress.”

Many lawyers have adopted electronic case management programs that most often use the Web as their platform for access. So much document processing has shifted to the Internet that many law firm managers feel confident that work can continue in all but the most devastating disasters.

“Documents and messaging are two big platforms for our firm, and they aren’t located in Washington,” says Wiley of Womble Carlyle. “If they cannot access them through the Washington office, as soon as they can get to a hotel computer or a Starbucks with wireless or a kiosk in an airport, they’re back to work.”

There is a debate among professionals about how best to store electronic documents. Some experts believe that records that are vital to the firm and client should be copied and then kept off-site, shipped to a distant retention facility that is not only outside the city but also outside the region.

For Wiley, distant storage just makes sense. “We’re in 14 different locations and nine cities,” he says. “Even if everything goes out, the lawyers can still practice. The only things we have locally are the machines [i.e., computers]. The data and work product are backed up in multiple locations.”

Others favor using the Web as the receptacle of last resort for key documents and data. Many companies offer Web-based systems that have enormous storage capacities and allow for access from anywhere. The only complaint against them has been that they might be susceptible to security breaches.

Kennedy says that charge is questionable. “Secure compared to what? There is an assumption that what a law firm is doing is always secure when it’s in the office. I’m not convinced by that argument. Look at what happened in New Orleans.”

What is essential for the disaster planning manual is to establish a data recovery site where a technology team leader can work with other law firm staff or contractors to recover documents from computers, PDAs, data tapes, and CDs. Even the most damaged computer may hold some valued data if experts are given the time to lift the information from the hard drive.

For Joel Bennett, a solo practitioner in Washington who specializes in employment law, disaster preparedness isn’t about pricey agreements with distant Web providers or locking disks away in storage vaults in Nevada. His solution to disaster planning for documents is fairly simple: do it yourself.

Bennett uses a thumb drive (for tech novices, that’s a small hard drive that plugs into computers and can be easily transported) to transfer newly created or updated files between his downtown office and his Gaithersburg, Maryland, home every day. He meticulously updates those files, allowing for three separate copies of the documents to exist at all times (home, office, and thumb).

“What I’ve done seems to be reasonably prudent,” says Bennett. “You can spend a million dollars and have a better system, but is that overkill? For a typical solo, I’d say yes.”

Is there more he could do? Probably, but Bennett is philosophical about the lengths he can and will go to. “My attitude is that you can only do the best you can. If Gaithersburg, Maryland, is leveled and Washington is leveled and I’m dead, there’s not much anyone can do. I’m not in a situation where I need to have a server backing up my files in Outer Mongolia.”

Business Continuity
As the work continues on the disaster recovery manual, think about next steps. The employees are safe. A new office is up and running, and the information is accessible and secure. It’s time to call the clients and let them know how the firm has fared, whether the disaster has crippled the firm for months or slowed it for a few days.

The firm’s business continuity team should have designated a point person or persons to contact clients, letting them know of the firm’s new location, how to contact lawyers if necessary, and advising them on the status of their cases.

For some clients, how a law firm handles disaster recovery and business continuity may be a factor in their selection. Clients have been known to ask firms to submit disaster planning information in their requests for proposals.

“If a firm does not plan, and it gets hit, then the clients of that particular firm have to ask themselves, with all things being equal, do I want to continue doing business with a firm that knew the risks and elected not do anything about them?” says Copenhaver. “That’s not the first question your typical client asks him- or herself when they look for a firm, but it has to be on the list.”

Leary says that every Akin Gump client of any size pays attention to disaster recovery. “All of our assets leave the building every night,” he says. “Therefore, could we operate at 60 percent if nobody came back the next day? Our clients want to know. Our clients are running pharmaceutical labors or manufacturing plants. They have to think about disaster recovery, and they expect us to.”

Law firms must have a plan for contacting the federal and local courts as well, alerting government officials to the status of the firm and asking for continuances or extensions based on the firm’s predicament. It also presents an opportunity to obtain some documents that might have been lost in the disaster. Of course, that assumes that the courts themselves haven’t been overwhelmed by a crisis. In New Orleans, while the federal courts are slowly returning to normal operations, the local courts remain in disarray, with computer systems and documents lost or destroyed.

Law firm leaders will also want to lay out a plan in the recovery manual on how best to contact other counsel—both those who are working in tandem and those in opposition to the firm—to ensure that everyone is alerted to the problems the law firm is facing. Again, this presents an opportunity to obtain documents lost in the crisis.

“The basic practices you used to rely on go out the window,” says Kennedy. “A disaster requires law firms to think beyond the traditional boundaries.”

Long-Term Viability
At the end of the day, disaster planning is less about emergencies and more about the long-term viability of the law firm. Any bump or hiccup along the road has the potential to trip up even the most powerful, forward-thinking firm. Without a plan to guarantee that mission-critical operations continue, it will be difficult for even the savviest management team to ensure the firm’s continued success.

Admittedly, it can be hard to take some of the disaster scenarios seriously. Much of disaster futuring requires the kind of nightmarelike creativity used by the writers on the television series 24—danger lurks everywhere, and it’s impossible to do anything but react with shock when it finally strikes.

Setting aside the thriller aspects of the process, disaster planning experts say it’s essential that firm team leaders take it seriously and convince their colleagues to do so. Poll likens the reluctance of some lawyers to get serious about disaster planning to how the average person thinks about death. “Disaster recovery in the minds of law firms is equivalent to the issue of mortality, because it will never happen to us, we think. That’s somebody else’s worry.

“If you take it out of the context of disaster recovery and put it into the larger context of business continuity, then maybe, just maybe, you get them away from the issue of mortality. If you talk in terms of disaster recovery, they’re still thinking it’s not going to happen. If you look at it in terms of business succession and the success of the firm, they can wrap their minds around that and make it work.”

But all this in the end is planning for a contingency that everyone hopes will never happen. Like many law firm efforts to assess risk and then make choices, disaster planning, emergency preparedness, and business continuity are all best guesses backed up by comprehensive plans.

“It’s like any insurance policy,” says Leary. “It’s mandatory for the firm to have it, and you hope you never have to use it.”

Freelance Sarah Kellogg wrote in February about the impending overhaul of the Telecommunications Act.