“Never in my wildest dreams did I think something like this would occur,” asserted the chairman of California’s Santa Clara Valley Transportation Authority (VTA) during a press conference this past May. The media had gathered after the workplace shooting by a VTA employee who killed eight of his colleagues, causing a chaotic evacuation of the transit authority’s facilities and the suspension of the city’s light rail service. Police responded quickly to the shooting. Upon their arrival, the shooter allegedly turned his gun on himself.
Safety and security professionals who listened to the VTA chairman’s statement to the media likely asked themselves “why did you NOT think something like this could occur?” Perhaps security managers at the transit authority were well prepared for such an event, and the chairman misspoke. Regardless, the VTA’s light rail service is still suspended. The beleaguered agency succumbed to a one-two-three punch of the ongoing COVID-19 pandemic, a ransomware attack that paralyzed its computer systems for several days in April and now the aftermath of a workplace shooting. The effectiveness of the VTA’s emergency response plan (ERP) for handling security threats is not yet known. However, it is not too early to remind any transportation entity that planning for a crisis is a critical business necessity.
Developing and implementing an effective ERP is not easy. It can cost a lot of money, time, and resources. And it requires expertise and focus. Money is required to pay the salaries of safety/security professionals, incentivize security for executives and staff, develop solid training programs, procure emergency supplies, and implement recommendations from others to improve security. However, in the public domain, the cost of a security failure can become enterprise threatening. Restitution for injury or death, penalties, litigation, and the indirect costs of committing resources to address the aftermath will always end up costing the company far more than would have ever been required had leadership committed greater resources and focus on security initially and continuously.
Any transportation organization — whether it be an airline, cruise line, bus line or rail line — will be expected to cooperate with local authorities, respond to media inquiries, provide immediate care to victims, communicate with its employees, take action to resolve deficiencies, and continue to conduct operations for its very survival and reputation.
The Basic Tenets of the Plan
The ERP is essentially a set of procedures that apply to what may be the most difficult time faced by a transportation organization. There is no right or wrong way to develop an emergency response plan — as long as it works. However, it must be clear, comprehensive, and understood by the people on the team. Employees cannot be reasonably expected to respond appropriately when faced with a situation and an overwhelming number of unknowns that are way outside of their experience.
Developing the ERP should never be a “boilerplate” exercise. Taking someone else’s plan and “filling in the blanks” is a recipe for failure. The plan must be tailored to the unique aspects of the organization — size, scope, expertise, resources — and it should cross the entire organization with respect to priorities, resources, and costs. Moreover, most events will not justify a full-blown response, which is why the plan should address categories of events to facilitate the tailoring of the response to be effective without massive inefficiency.
Communication and coordination with city, state and federal law enforcement is key. Communications with the media, and the organization’s employees is also necessary. Finally, providing timely, competent and compassionate support for victims and families in the aftermath of a crisis is perhaps the most important feature of an ERP.
Keys to a Solid Emergency Response Plan
- Regardless of the mode of transportation, communication and coordination with city, state and federal law enforcement is key to any effective and successful emergency response plan (ERP), experts say.
- Communications with the media and the organization’s employees is also necessary.
- Most events will not justify a full-blown response, which is why the plan should address categories of events to facilitate the tailoring of the response.
- The use of detailed checklists is a key ingredient of a good emergency response plan.
- Providing timely, competent and compassionate support for victims and families in the aftermath of a crisis is perhaps the most important feature of an ERP.
How the Airlines Do It
The airline industry is very familiar with what is needed — and required — to respond appropriately to an aircraft accident, but a security crisis is another matter. “Our accident ERP is black and white with its own structure. Then, we have a separate structure for ‘everything else’ that is handled by our Crisis Management Team,” explained Penny Neferis, a 22-year veteran at JetBlue Airways who serves as its director of Business Continuity, Disaster Recovery and Emergency Response.
Neferis told Transportation Security International (TSI) that the Crisis Management Team is the core of managing over 20 categories of crises — many of them for security events such as cybersecurity breaches, active shooter situations, and bomb threats. Other non-security issues are also addressed by the team, such as severe weather, fleet groundings, transit strikes, IT outages, and, of course, operating during a pandemic.
“These plans are built to get the departments through the first few hours,” Neferis added. “Our active shooter plan is probably drilled the most.” As an example, Neferis cited the January 2017 shooting near the Terminal 2 baggage claim area at the Ft. Lauderdale International Airport in Florida. Five people were killed and six others were injured. The 26-year-old shooter was taken into custody several minutes after he started shooting. The shooting led to the cancellation of over 300 flights and the evacuation of 10,000 people from the terminal, many of whom spilled onto JetBlue’s ramp area. “Fortunately, our team there had just been through a training exercise, and that really made a difference.”
Alaska Airlines/Horizon Air utilizes a similar emergency response structure, with a separate ERP for aircraft accidents, and a Crisis Management Team for everything else. “Our plans cover anything that could disrupt the crucial function of our stations,” Jana Osborne told TSI. Osborn is the manager of Alaska Airlines’ Emergency Response and Business Continuity department. She has been with the company for 27 years and in her current role for the past seven. She explained that most major airlines recognize the importance of emergency response and are more than willing to share their challenges with each other. “We come together every other week in a teleconference and share lessons learned,” Osborn noted. “We are a tight knit group.”
A key ingredient of any ERP should be the development and use of detailed checklists for employees to utilize in the wake of a crisis. Checklists should be developed for each key function and identify tasks to be performed in a logical order. Developing a checklist also forces planners to delve deeply into their operation and establish effective training.
If you think checklists are “overkill,” consider the possibility that 30 percent of your key trained staff will likely not be available during a crisis. A simple, step-by-step checklist can be used by back-up personnel — it may not be ideal, but it is far better than having no one available to handle a task at a critical moment. Additionally, checklists that require the user to record the outcome of each step can serve as a “log” that can then be used to assess the organization’s response.
JetBlue uses checklists and updates them frequently. “For our Crisis Management Team contacts, we update them almost daily,” Neferis explained. “For the plans themselves, we look at them during our quarterly exercises and ensure that all affected departments — such as the operations teams, HR, risk and legal — have their checklists. We make the time to write checklists in advance to get people to think through a crisis. It helps with lessening the chaos, as opposed to just winging it.”
Smaller companies may not have the resources to develop and implement an ERP or crisis management team, creating a market of third-party providers that can do the job for them. These companies can provide employee assistance programs, family assistance, communication centers, media relations, and more. Even large companies like JetBlue and Alaska Airlines — who both developed their own ERP capabilities in house — occasionally bring in help from the outside. According to Neferis, JetBlue has arrangements for “business partners” to assist in certain areas when needed, such as crisis communications. The airline will also will periodically “pull folks in from outside the company to take a look at the plans.”
One of these outside firms is Black Swan Solutions, a part of Empathia, Inc. that provides crisis management services to transportation entities and others. The term “black swan” is synonymous in the industry with a low probability, high impact event. With a motto of “Prepare/Respond/Recover,” Black Swan Solutions caters to not only commercial air carriers of all shapes and sizes, but also bus lines, city transit systems, and cruise lines. “We provide the whole spectrum of support for a company,” stated Rick Hoaglund, director of Crisis Management Services for Black Swan.
“We can come in and consult with a company to set up their own program, or we can provide all of the support for them.”
Hoaglund should know. His previous job was working for Amazon in its travel risk management group. He saw first-hand the importance of preparing for IT security breaches. In his current role, Hoaglund sets up communication lines for companies that experience database breaches so that customers can have their issues resolved and their security restored. These ad hoc “incident response centers” — the new vernacular for what used to be “call centers” — can be stood up in a moment’s notice for not only IT breaches, but for any security crisis such as a bus line hijacking or cruise ship emergency.
TSI asked Hoaglund if the different modes of transportation require different types of response plans. “Sure, there are unique aspects to every company, but the approach to setting up an ERP for any mode is basically the same,” he replied. “For example, the reporting processes of one company may differ from another.”
But for any mode of transportation, Hoaglund stressed the importance of “outreach” and the tenet of “taking care of people.” For example, if a bus was hijacked or a hostage situation occurred, Black Swan would ensure that the family members of those on the bus would be kept apprised of the situation. He also explained that a security event aboard a cruise ship may also need to be handled differently, since the ship is basically on its own until it can pull into a port. Until then, the crew will need to be self-sufficient in providing medical support, passenger needs, etc.
Still, Hoaglund advises that any company who is developing an ERP should go with a broad approach and cover the basic tenets of an ERP mentioned above, rather than getting caught up in trying to game out every possible crisis scenario.
Leadership, Training, and Exercise: Ingredients for Success
When it comes to leading an organization’s emergency response planning or crisis management, experience is essential — especially in the early stages when a large-scale crisis is unfolding. There are few organizational structures where so much authority is placed at a level lower than the CEO. The ERP structure should already have the CEO’s full support, or its implementation could not exist. In smaller transportation entities, the ERP is usually run by someone as an “additional duty,” making senior management support even more critical.
The fact that the plan is rarely implemented highlights that training and exercises are extremely important. Resources for the ERP are not a one-shot deal. Regular review is required to make sure that people are still where you thought they were, and still available to do what you had planned for them. Communications gear and other equipment must not only be procured, but also maintained and tested regularly.
An outstanding plan with no training will fail, while a mediocre plan that is well-taught and practiced will likely succeed. “You can’t let these plans collect dust,” said JetBlue’s Neferis. “You have to pull it out and talk about.” Osborn agrees. She said that Alaska Airlines conducts ERP drills two or three times a year. Both airlines conduct an “after action review” of each exercise and make any necessary adjustments to the ERP.
In the end, an emergency response plan is required because it addresses an area that the company rarely, if ever, has experience dealing with, and an area in which failure is not acceptable. What happens if your transportation enterprise lacks a solid ERP? “You run the risk of ruining your brand —and that can happen so quickly these days with social media,” Osborne warned. “You don’t want to harm the relationship with your customers, or your own employees, in the wake of a crisis.” She concluded with a quote from Benjamin Franklin: “If you fail to plan, you are planning to fail!”