George Mason University has four campuses in Northern Virginia and 30,000 students, of whom 40 percent are graduate students. About 4,000 students live on campus. One of our campuses is just one mile from the Pentagon. Another of our campuses is a major center for biodefense research. Many of our staff and students have family members who work for the federal government in Washington, D.C., or for the Pentagon in Arlington.
On September 11, 2001, when terrorists struck the World Trade Center Towers and the Pentagon, no one knew the extent of the damage, how many people had been killed or injured, or whether other targets would be hit. The communication systems being used by regional police and fire departments were not interoperable with each other or with the university's system. Our only news came from television, which mainly showed a continuous repeat of the planes hitting the towers. Even if we had been able to get up-to-date information about what was happening in the region, we had no system set up to notify people via the Web, GMU-TV, or otherwise as to what was happening and what they should do.
Although we tried to telephone key employees to initiate protective measures, often we could not reach them, either because we did not have their cell phone numbers readily accessible or because the cell phone towers on campus were insufficient to sustain the traffic. The disaster recovery plans for our major systems were out-dated and untested. We had no procedures to evacuate the campus or to shelter-in-place. Meanwhile, students and staff were trying desperately to reach loved ones at work in D.C. or the Pentagon, but the region's cell networks were overloaded. People began to panic.
Mason's president sent a runner to the offices of each of the vice presidents and deans asking them to walk calmly around campus, especially the major gathering places for students. Each of us then went to each of our direct reports and asked them to do the same. When the CIO went over to the library to ask the library director to walk around campus, she found him in a meeting with the library managers. They immediately partitioned the library and the campus into sections to ensure full coverage and began walking.
We informed frightened students and staff that the cell networks were overloaded and told them that the best thing they could do would be to refrain from attempting to call until they received word that the communications systems were operational. The message was, "If you want to help, stay off the phone." We asked students and faculty to resume classes but not to expect that the scheduled topics could be covered. We learned later from students and staff that the sight of administrators, including the president, walking calmly around campus and answering questions considerably reduced their anxiety.
Guiding Principles
The university realized that it had to make substantial investments to improve its ability to respond to emergencies. The list of possible remedial actions seemed infinite, with correspondingly limitless needs for funding to implement them. As we look back at the strategies we chose and the investments we decided to make, we see that three concepts drove our choices.
First, we understood early on that we needed to form partnerships if we were to achieve success, given limited resources. We realized it would not be possible to make significant progress on so many fronts unless we cultivated partnerships and then invested what was needed to make sure they operated effectively.
Second, we used what we knew about principles of learning and communication to guide our efforts at educating the campus community about what to do in an emergency and how to find resources to assist themselves. This is extremely important when you are designing a response program. By "principles of learning" we mean concepts such as the need for reinforcement of positive behavior, providing easy access to up-to-date learning resources, using language and media that fit the learners in your target audience, and periodic assessment of learning objectives and outcomes.
The third ingredient for success is perhaps the obvious one: the university's executive leadership had to commit financial resources and their own time and energy to selecting strategies, funding them, and assisting with their implementation.
Strategies for Improving Emergency Response
Following are seven of the strategies we used to improve the university's capabilities to respond to emergencies.
We created and trained a Crisis Emergency Management Team and contracted with a conference call company to provide its services immediately to the team in an emergency. The Campus Police, Safety Office, and Physical Plant staff now carry their choice of a Nextel phone or a BlackBerry, each of which has the "touch to talk" feature so that they can work independently of the cell phone network, communicate with each other, and let people know when the next conference call will take place or where to meet. (The Nextel system works even for people out of town.)
Most buildings now have on-site building coordinators who are responsible for knowing what to do in an emergency; in addition, larger buildings have floor wardens as well as building coordinators. Sixty NOAA Weather Radios were distributed to the building coordinators. These radios alert coordinators to regional emergency conditions and can also be used to distribute Mason-specific emergency information.
We created university-wide notification lists, policies, and response plans that include the location and facilities of various sites designated as emergency operations centers. The actual site used for a specific event will be selected based on the type of emergency, but each site is provisioned to serve as an operations center if called upon to do so.
These lists and plans are reviewed twice a year by the Safety Office, which also updates them in anticipation of any potentially disruptive event, such as the basketball team going to the Final Four or an approaching hurricane. This is a resource-intensive process but essential to making sure that these important documents are kept up-to-date and useful. The emergency policies and plans are available for review on the university's Web site. To keep the pages fresh, we post links to the documents, not the documents themselves. This means that people do not have to update the Web page when something changes, but rather can update the source document using a simple word processing program.
The Safety Office hired a trainer who teaches building coordinators, floor wardens, and front line people what to do in an emergency and where resources can be found. The Safety Office sends e-mail notices twice a year reminding people how to access 911 on campus. The office sends e-mail notices on other safety and emergency planning issues several times a month and also publishes a quarterly newsletter. The office conducts fire drills twice a year for each residence hall and once a year (if requested) in administrative buildings. The Safety Office is purchasing 2,000 flip books with emergency information and providing one to every office on campus.
The underlying philosophy at Mason is to educate people to "stay in place and seek information." Mason is part of the county's electronic notification system, which can send messages about a Mason emergency only to Mason employees and students while providing important regional information such as weather, traffic, and so forth.
GMU-TV and the university's Web site now have systems in place to switch instantaneously to alert mode. Members of the president's office have been trained how to do this and also how to keep the emergency content up to date, as have several people in the electronic publications office. A hot site on a campus in a neighboring county mirrors the Web site.
The provost established a policy that faculty use students' gmu.edu addresses for communications, even if the student has other e-mail addresses, and that all official university communications to students also be sent to their gmu.edu e-mail accounts instead of by postal mail. All faculty are now provided with up-to-date listservs containing the e-mail addresses of the students enrolled in their courses. Previously, faculty who were determined to communicate by e-mail had to collect students' e-mail addresses in class and manually enter them into a database to produce a listserv that often became outdated as students added or dropped the class.
The e-mail system had limitations that required us to break e-mail lists into segments and send one segment at a time, so it sometimes took three days to reach all the students. The system was upgraded so that broadcast e-mails can be sent to all students instantaneously. Faculty can send course-specific e-mails to just the students in the class, notifying them of alternative arrangements. The university is in the process of rolling out a portal that will send emergency messages to an announcements database that is activated each time a person logs into the portal.
The cell phone infrastructure on campus has been upgraded for greater coverage and reception, including the installation of additional towers.
The Safety Office applied for and received a $150,000 grant from the Virginia Department of Emergency Management to purchase the same radios as the local fire and police jurisdictions purchased after 9/11. Now we all use the same radios (digital and analog).
The Safety Office periodically sponsors interagency crisis simulations with follow-up meetings to go over lessons learned. Much stronger relationships have been built among first-responder agencies and with the university.
We're now prepared to feed, water, and house students in our field house and basketball arena, but not for more than two days. This will give us time to finalize arrangements to house students in the event of a localized crisis, such as a fire. (The university has contracts in place with area hotels that it uses when the demand for housing exceeds the supply.) In the event the entire region is hit, we will use these two days to assess the situation and decide which of the emergency housing/transportation plans should be implemented. For example, we have negotiated agreements with local school districts to use their buses to transport students to hub airports outside the region so that those residential students whose homes are safe can fly home in the event of a serious regional emergency. We believe that this is the most appropriate action to take because we are located in a sensitive region and, if possible, we want to free up space in the residence halls so that it can be used to house displaced people from the region.
We also have plans in place to serve as a post-event inoculation site in the event of a medical emergency, such as a smallpox epidemic, and as a staging area for emergency response equipment coming into the D.C. area.
The university formed an Executive Enterprise Risk Management Group (EERMG) to oversee the processes of risk assessment, hazard mitigation, and business continuity planning. The senior vice president for finance and administration chairs the EERMG. Also serving in the group are the controller, the director of the Safety Office, the director of internal audit, the vice provost for academic affairs, and the CIO.
EERGM has identified 16 units on campus as the highest priority for business continuity. It initiated a process that involves both a risk assessment survey and in-person risk assessments by a team that includes the IT security coordinator and the director of the Safety Office. Personnel risks, technology risks, and physical risks are assessed. Among the findings of the early risk assessments are:
- Most buildings and offices are not secure, which is not surprising since it has not been the function of a university to keep people out but rather to invite them in.
- Few offices have backup procedures for their paper or computer files.
- Even those offices that have disaster recovery plans in place do not have business continuity plans.
The in-person visits by the risk assessment team are key to the usefulness of the risk assessments and the responsiveness of the office heads. Often the team can take immediate steps to mitigate some of the risks. For example, the Registrar's Office did not have a second fire exit in the back of the building. The team arranged to have one built for them. The team helped the office move its server so that it is behind the firewall. The team was also able to get funds to key off an elevator leading to the Finance Office, which is housed on the top floor of a rented building where nonuniversity tenants are on the lower floors. If the risks identified are too complex or expensive to remediate at the time, the EERMG develops and prioritizes mitigation strategies.
The Safety Office assists departments with the creation and implementation of table-top exercises designed to test the usefulness of the departments' disaster recovery and business continuity plans. Often these exercises reveal gaps in planning, including assumptions that most likely will not be valid in a true emergency. The office also conducts a minimum of four university exercises per year to test the emergency response plans.
We are also using much outside help to assist us in risk assessment. One company with particular expertise in biohazards recently conducted a comprehensive assessment of risk on the campus that houses most of our biological research.
We have an open contract with a company that assesses the state of security on computer servers. We call them to do an assessment anywhere in the university if either the IT organization or the department running the server has concerns.
We are working closely with the Federal Department of Homeland Security (DHS). They recently funded a network of smart cameras on campus as part of a pilot program. DHS also conducted a three-day training session for key people on campus that covered threat assessment, criticality assessment, analysis of terrorist targets, priority assessment planning, and vulnerability assessment.
The university was recently awarded a Federal Emergency Management Agency grant through the Hazard Mitigation Grant Program. With the aid of the grant, the university hired James Lee Witt Associates to assist the university with business impact analysis and planning. It is expected that the plan developed will guide our business continuity strategies and funding for years to come.
Conclusion
While the task of building capacity in the university to respond to emergencies may have seemed overwhelming at first and beyond the institution's ability to finance and implement, we found that careful planning and prioritization of strategies enabled us to achieve our goals. Substantial progress was made because we built effective partnerships inside and outside the university, we used research on how people learn and communicate as a basis for selecting strategies, and we had the commitment and involvement of the executive team.