AT&T touts continuity of operations plans

The government should leverage the expertise of private industry when it develops continuity of operations plans, an AT&T Corp. executive told Congress today.

John Kern, AT&T's network continuity director, told the House Committee on Government Reform that his company has spent more than $300 million over the last 10 years to ensure its networks remain operational in the event of a disaster or other outage.

Rep. Dutch Ruppersberger (D-Md.) asked Kern if AT&T was ready to maintain network operations in case a catastrophic event hits a major metropolitan area.

"Yes," Kern said. "We were prepared for 9/11. ? We were able to respond and deploy equipment to meet the needs of [our customers]. Since 9/11, we've increased our capabilities and added more people to the process."

Kern testified at a hearing into the status of continuity of operations plans at federal agencies. In February, the General Accounting Office released a report that questioned whether agencies' plans to keep the government running complied with guidelines set forth by the Federal Emergency Management Agency.

"The guidance from FEMA is not clear, which made for inconsistent plans," Linda Koontz, the General Accounting Office's director of information management issues, said in her testimony. "And FEMA has not provided regular oversight on agency plans."

But Michael Brown, undersecretary for the Homeland Security Department's Emergency Preparedness and Response directorate (FEMA), said GAO's assessment is incorrect.

"We are getting there," Brown said at the hearing. "All major departments have continuity of operations plans in place, and we have looked at them. They need to be fine tuned and improved, but all of the agencies have them."

Kern said that in light of the drastic nature of the Sept. 11 attacks, AT&T has begun planning for scenarios that were previously considered unlikely, such as biological attacks. The Bedminster, N.J. company will participate in the next congressionally mandated Top Officials exercise (Topoff 3), which takes place in New Jersey and Connecticut in April 2005.

The Homeland Security Department runs the Topoff exercises to simulate attacks of weapons of mass destruction. They are meant to test readiness, improve coordination and identify areas for improvement. Topoff 2 took place in May 2003 in Chicago and Seattle.

Kern said continuity of operations plans should include a certain amount of flexibility so that organizations can respond to unforeseen circumstances. Although AT&T did not plan for the types of attacks carried out Sept. 11, its plan was flexible enough that it could respond quickly and restore service, Kern said.

Kern told lawmakers that systems should incorporate "continuity by design" to take into account potential failures even before IT groups start planning for them.

"In some cases, changes in technology present a challenge. In some cases, they present an opportunity," Kern said. Wireless connectivity, for example, may factor into an agency's continuity of operations planning, because it allows groups to set up contingency sites without laying wires.

Committee Chairman Rep. Tom Davis (R-Va.) welcomed input from AT&T and the commercial industry in planning for continuity of operations.

"We could sometimes use a little of the private-sector culture in government to stay ahead of the curve on some of these things," Davis said. "Because we're not in a competitive mode, we tend to be more reactive than proactive."