THALES RESEARCH AND TECHNOLOGY (UK)   White Paper




                                                       White Paper

...
Author                    R J Craddock
                                        Date                      22/6/2006
       ...
White paper
         Crisis Management Models and Timelines                                                               ...
White paper
         Crisis Management Models and Timelines                                                               ...
White paper
         Crisis Management Models and Timelines                                                               ...
White paper
         Crisis Management Models and Timelines                                                               ...
White paper
                  Crisis Management Models and Timelines                                                      ...
White paper
         Crisis Management Models and Timelines                                                               ...
White paper
         Crisis Management Models and Timelines                                                               ...
White paper
         Crisis Management Models and Timelines                                                               ...
Upcoming SlideShare
Loading in …5
×

Crisis Management Models and Timelines

2,344 views

Published on

0 Comments
0 Likes
Statistics
Notes
  • Be the first to comment

  • Be the first to like this

No Downloads
Views
Total views
2,344
On SlideShare
0
From Embeds
0
Number of Embeds
14
Actions
Shares
0
Downloads
73
Comments
0
Likes
0
Embeds 0
No embeds

No notes for slide

Crisis Management Models and Timelines

  1. 1. THALES RESEARCH AND TECHNOLOGY (UK) White Paper White Paper Crisis Management Models and Timelines www.thalesgroup.com
  2. 2. Author R J Craddock Date 22/6/2006 Reference TRT060601 Issue 2 Abstract Two models of crisis management are presented. The first shows a timeline of a crisis, along with the activities involved at each stage, and the second focuses on the technological capabilities required to facilitate the response to a crisis. Keywords Crisis management, Emergency Services, Disaster Recovery Planning Thales Thales is a world leader in mission-critical information systems covering three major markets: Aerospace and Space, Defence, and Security. We are present all along the value chain, providing equipment and systems, systems integration, prime contracting and services. Thales meets the communications, information and security needs of people in countries throughout the world with operations in more than 50 countries and 68,000 employees worldwide. Thales Research and Technology (UK) Limited Thales UK's Reading-based research & technology facility is the UK arm of the Thales corporate research centre. Its activities focus on providing solutions: Security and Communication Systems, Galileo and Position-Based Systems, and Enhanced Digital Environments. These are based on the key technologies of IP Networks and Network Security, Wireless Communications, Sensors and Signal Processing, and Navigation and Positioning. The facility offers a wide range of consultancy and development services to European Government Agencies and to industry throughout the world. Thales Research and Technology (UK) Limited Worton Drive, Worton Grange Reading, Berkshire, RG2 0SB, UK Company Registration No. 774298 mailto:enquiries.trtuk@thalesgroup.com ©Thales Research and Technology (UK) Limited 2006
  3. 3. White paper Crisis Management Models and Timelines 3 Introduction Two models of crisis management are presented in this white paper. The first shows a timeline of a crisis, along with the activities involved at each stage, and the second focuses on the technological capabilities required to facilitate the response to a crisis. Timeline of a crisis The crisis timeline is composed of four main phases as shown in Figure 1 and an expanded view of the phases occurring after the Point of Incident Occurrence is shown in Figure 2. Figure 1 also shows the different levels of normality that occur during the crisis and the different things that can be observed, to determine the current phase of a given crisis and Figure 2 shows the response utilised in each phase. An expanded view of the activities required in each phase is shown in Figure 3. It is important to note in all three figures that the boundaries between the different p h a s e s a r e f l e x i b l e a n d s o m e p h a s e s m a y o v e r l a p . Phases of a crisis The crisis phases and their activities are described below: Pre-incident phase: This is a period of time prior to an incident occurring. Incident pre-cursors may exist, the detection of which will warn of an incident and enable prevention and preparation to take place. This phase consists of the following top level activities: • Prediction – determination of what incident is going to occur, and when it is going to occur, is the key to minimising the effects of an incident. Once the incident has been accurately predicted, prevention and preparation responses can be formulated and implemented. • Prevention – the best way to minimise the damage done by an incident is to prevent it from occurring, however, not all incidents are preventable, e.g. natural disasters. In addition, some preventable incidents may be detected too late to prevent them. Figure 4 shows where prevention fits into the overall crisis timeline. Prevention measures are initiated by the detection of incident pre-cursors. Activities to prevent the incident occur during the critical prevention phase, which starts prior to both the point of inevitability and the point of incident occurrence. This phase continues until the point of successful incident prevention, which is the point in time at which the incident is known to have been prevented. After this phase, the post-prevention phase is entered, in which the prevention response is reduced / removed and the situation returns to normal. For some incidents, prevention measures may need to remain in place indefinitely to prevent the incident occurring. Incident prevention measures may not always prevent the incident but only delay it, as shown by the dotted line for observing the incident occurrence. • Preparation – there are two forms of preparation: Preparation of the response designed to prevent the incident Preparation for the incident. This occurs when an incident cannot be prevented or it is too late to prevent the incident. In both cases, the time remaining can be used for preparation to put in place measures to minimise the effects and resulting losses of the incident. ©Thales Research and Technology (UK) Limited 2006
  4. 4. White paper Crisis Management Models and Timelines 4 Inc id e nt Inc id e nt Inc id e nt ine v ita b le o c c urs c o nc lud e s P re -inc id e nt P o st-o c c urre nc e P o st-inc id e nt N o rm a lity N o rm a lity A b n o rm a lity N o rm a lity d isru p ted s ta rts to re tu rn Inc id e nt e vo lve s C y c le re turns to P re - Inc id e nt p ha se Tim e OBSERVABLES POTENTIAL PR EC UR S OR S IN C ID E N T P O STC UR S OR S S IG N S O F R E C O V ER Y Inc id e nt o c c ur s & s it ua tio n w o rse ns R e c o ve ry 1 . D o N o thing N o d e te c tio n o f pre c urso rs, inc id e nt o r p o stc urso r s ta k e s lo ng e st POSSIBLE ACTIONS DETECTION INCIDENT 2 . R e co g nit io n & Inc id e nt o c c ur s, s it ua tio n R e c o ve ry R e sp o nse a na ly se d & m a na g ed re q uire d PRECUSROR DETECTION 3 . P re d ic tio n b ut Inc id e nt o c c ur s, s it ua tio n a na ly se d & P o te ntia lly no t p re ve nt io n m a na g e d ea rlie r. P o te ntia lly le s s d a m a g e tha n 2 q uic k e r re c o ve ry PRECUSROR DETECTION 4 . P re d ic tio n & N o re co ve ry Inc id e nt p re ve nte d p re ve ntio n re q uire d D e te c tio n & M o n ito ring Inc id e nt P re d ic t io n PROCESSES Inc id e nt R e c o g nitio n & A na ly s is SYSTEM R e c o ve ry Inc id e nt P re ve nt io n A na ly s is R e sp o nse trig g e re d b y rec o g nitio n Inc id e nt P re p a ra tio n R e c o ve ry & R e sto ra tio n R e sp o nse trig g e re d b y p re d ic tio n Inve st ig a tio n P o st inc id e nt inq u ir ie s Figure 1 Top level phases of a crisis ©Thales Research and Technology (UK) Limited 2006
  5. 5. White paper Crisis Management Models and Timelines 5 Response Consolidation / escalation phase Recovery phase Initial Major incident response stand-down Major incident declaration Restoration phase Major Investigation incident stand-by Post event Return to inquiries normal Time Post Occurrence Post Incident Incident occurs Figure 2 Expanded view of post occurrence and post incident phases of a crisis. Adapted from [1] and [2]. ©Thales Research and Technology (UK) Limited 2006
  6. 6. White paper Crisis Management Models and Timelines 6 Pre-Incident If not preventable Prediction Preparation for incident prevention Preparation for incident If preventable Prevention Initial Response Consolidation phase Stand-down Incident Occurrence Post-occurrence Recognition Response Recovery Initial Response Consolidation phase Stand-down Investigation Post-Incident Restoration Restoration 1: Restoration 2: Short-term restoration - days Long-term restoration – weeks+ Discussion activities Investigation Cycle returns to Pre-Incident Phase Figure 3 Detailed crisis activity phases ©Thales Research and Technology (UK) Limited 2006
  7. 7. White paper Crisis Management Models and Timelines 7 Point of Point of Successful Point of Point of Incident Incident Incident Inevitability Occurrence Prevention Conclusion Phases Pre-incident Post-occurrence Post-incident Normality Period of abnormality Return to normality Incident Observables Incident Occurrence Incident Precursors Incident Postcursors Signs of recovery Phases Post-prevention Critical prevention phase Prevention Return to normality Observables Incident Incident Precursors Occurrence Monitor prevention measures Signs of normality returning Time Figure 4 Crisis phases diagram showing crisis prevention phases Incident occurrence: This is the instance in time at which the incident occurs (or starts to occur), if it has not been prevented. After this point, the incident will evolve during the next phase. If not predicted, this is the first time the incident is detected. Post-occurrence phase: During this phase, the incident may get worse, e.g. by triggering other incidents, it may stay the same, or things may improve, e.g. emergency services intervene to resume normality as quickly as possible. This phase consists of the following top level activities: • Recognition – an incident response will vary according to the incident type, size, location and components (people and things). By recognising the incident, and establishing a profile for it (who and what is involved, potential evolution, etc), the best response can be devised and the incident effects minimised. The recognition activity continues throughout the entire post- occurrence phase, thus providing continuous monitoring of the situation as it evolves. • Response – using the recognition outputs, an appropriate response can be formulated. Incident evolution needs to be included in the formulation, and if the incident evolves in an unexpected way, the response will be adapted accordingly. The response consists of three stages: Initial response – During this stage, the situation is assessed and a full scale response is developed. As part of these activities, emergency responders may be put on stand-by, so they are prepared in case they are needed, and the situation may be declared to be a major incident, at which point each response agency will implement the relevant major incident plans. While the situation is being assessed and an appropriate response developed, any immediate issues are dealt with and action is taken in an attempt to prevent the incident escalating. Consolidation - During this stage, the full scale response is implemented and the incident monitored continuously. Any changes in the incident’s profile can then be accommodated into the on-going response. By the end of this stage, the incident with be under control ©Thales Research and Technology (UK) Limited 2006
  8. 8. White paper Crisis Management Models and Timelines 8 Stand down - During this stage, the incident is under control and the scale of the incident has reduced to a point where a full major incident response is no longer required by some or all of the emergency responders. As a result, the emergency response can be reduced. • Recovery – the incident draws to a conclusion and normality starts to return. Activities in this phase consists of concluding the standing down by the emergency responders and any immediate actions which can be used to start to restore normality e.g. re-opening roads closed due to the incident. The duration of this recovery phase does not typically exceed hours, but this can vary depending on the specific incident. • Investigation – as soon as an incident is detected, evidence is gathered for any future enquiries that may occur. Post-incident phase: The incident is likely to have a finite lifetime, e.g. in a fire, there is normally a limited amount of fuel to consume. Most incidents will conclude without intervention, however, without intervention the effects of the incident may be worse and / or the incident may last longer. At the end of its lifetime, the incident concludes and normality starts to return – the post-incident phase. This phase consists of the following top level activities: • Restoration – once the incident is over, normality returns over a period of time, which can take months or years for very severe incidents. Immediate restoration actions have already been initiated in the post-occurrence phase. Additional longer term restoration actions may be required to get things completely back to normal. In some cases, if no action is taken, normality will never return. Short-term restoration involves the actions which take hours and days to perform, e.g. providing alternative accommodation for people made homeless by an incident and long-term restoration involves actions which take weeks or longer to perform e.g. repair or rebuilding of homes damaged or destroyed during the incident. In addition, the emergency responders need to carry out any actions which are necessary to bring them back to full operational capability after dealing with the incident e.g. restock supplies. • Investigation – further investigation may be performed after the incident concludes, to provide information and evidence for any hearings, enquiries and criminal prosecutions that may arise. • Post-incident discussion activities – such activities include immediate incident debriefs and other types of incident discussions occurring some time after the incident concludes e.g. multi- agency debriefs, hearings, trials and inquiries. The aim of the debriefs is to identity and feedback areas for improvements. At the end of the post-incident phase, normality returns and activities return to those of the pre-incident phase Technology capabilities required for responding to a crisis In order to gain an understanding of the technological capabilities required to respond to a crisis, the model presented in Figure 5 has been developed. It is based on a perception of what an incident commander will require in order to deal with an incident that has just occurred. Typically, he will require a set of resources (including people) and a plan of what to do with them. These two areas can be addressed while measures are implemented to prevent the incident from escalating. Different incidents will require different resources and responses to deal with them, with the specifics being dependent on the incident under consideration. It is therefore important when developing a response to have an accurate and complete situation awareness. Obtaining such an awareness requires: • a set of information sources, including people, and sensors e.g. CCTV and automated alarms • resilient communications to get the information from the source to the commander • information processing, analysis and visualisation capability, so that the commander is quickly presented with a complete situation awareness. Plan development can be facilitated though information management capabilities, which can rapidly provide relevant information for the current incident, e.g. maps of buildings, expert knowledge, policies and procedures and any pre-developed plans for similar incidents. Decision enabling and planning ©Thales Research and Technology (UK) Limited 2006
  9. 9. White paper Crisis Management Models and Timelines 9 tools can help in producing the specific plan for the current incident, and simulation tools can assist in determining the effectiveness of the plan. The degree to which such tools will be useful will depend on the specific incident under consideration, since small, common incidents, e.g. chip-pan fires, are unlikely to require such capability, whereas larger incidents e.g. the Buncefield Oil Depot fire, would. Once the plan has been produced, and the required resources determined, resource allocation and tasking tools can be used to assign the best available resources to the incident, and route-planning tools can assist in getting the resources to the incident in the quickest way possible. When everything is in place, the plan can be implemented to resolve the incident. Plan implementation requires a continuously updated situation awareness, which provides information about how the incident is evolving. In addition, the situation awareness now includes the location and status of the resources that are being used to implement the plan. To facilitate plan implementation, resilient, secure two-way communications with the personnel involved are required, along with decision enabling and re-planning tools that can be used to help adapt the plan as the incident evolves. In addition to being useful when responding to an incident, the capabilities discussed here are also useful in the pre and post incident phases of a crisis. Both before and after an incident occurs, it is useful to have situation awareness of an area. In the pre-incident phase, incident pre-cursors can be monitored, and in the worse case scenario, the situation awareness capability can provide notification that an incident has occurred. In the post-incident phase, the recovery and restoration activities and response can be monitored. The technologies used in producing an appropriate plan at the time of an incident, are also useful when planning and preparing for future incidents. Such preparation includes training at all levels of responsibility, and simulation tools can assist in providing realistic responsive situations, which allow people to try out different ideas and exercise potential plans. Information Decision enabling Resilient processing Secure, resilient Communications communications & Re-planning & analysis tools network Information Resource Information visualisation sources – location Sensors & People Plan Situation Awareness Implementation Information management Decision enabling & Planning Route List of tools Planning Required Resources Appropriate Simulation Plan tools Resource allocation / tasking Figure 5 Technological Capabilities required for Crisis Response ©Thales Research and Technology (UK) Limited 2006
  10. 10. White paper Crisis Management Models and Timelines 10 References [1] London Emergency Services Liaison Panel, Major Incident Procedure Manual, 6th edition, July 2004. [2] North and Eastern Birmingham PCTs, “Responding to an Incident: An Operational Guide for Staff”, 2006, www.easternbirminghampct.nhs.uk/ docs/EmergencyPlanOpGuide.pdf, (27 April 2006) THE INFORMATION IN THIS DOCUMENT IS SUPPLIED "AS IS" WITHOUT ANY EXPRESS OR IMPLIED WARRANTY WITH RESPECT TO THE ACCURACY, COMPLETENESS, OR USEFULNESS OF ITS INFORMATION AND IN PARTICULAR WITHOUT ANY WARRANTY AS TO FITNESS OF SUCH INFORMATION FOR THE INTENDED PURPOSE. THALES NOR ANY PERSON ACTING ON ITS BEHALF:- A) MAKES ANY WARRANTY OR REPRESENTATION, EXPRESS OR IMPLIED, THAT THE USE OF THE INFORMATION IN THIS DOCUMENT MAY NOT INFRINGE THIRD PARTY RIGHTS; OR B) ASSUMES ANY LIABILITIES, WHETHER IN CONTRACT, TORT (INCLUDING NEGLIGENCE) OR OTHERWISE, WITH RESPECT TO THE USE OF, OR FOR DAMAGES RESULTING FROM THE USE OF ANY INFORMATION IN THIS DOCUMENT. NO RIGHT OR LICENCE IS GRANTED TO THE RECIPIENT IN RELATION TO ANY INFORMATION IN THIS DOCUMENT. ©Thales Research and Technology (UK) Limited 2006

×