RISKY THINKING - July 2009

by Michael Z. Bell
Principal Consultant, Albion Research Ltd.
www.RiskyThinking.com

A free newsletter providing essays, analysis, insights, and oddities related to Business Continuity, Disaster Recovery, and Risk Management.

To subscribe, visit: http://www.RiskyThinking.com/newsletter

Most essays are also available from the RiskyThinking website at http://www.RiskyThinking.com/.

Contents:

The 2009 Pandemic Flu – A Premature Retrospective
Some Pandemic Reading
Not Quite a Word From Our Sponsor
News Of The World
Administrivia, Subscribing and Unsubscribing

The 2009 Pandemic Flu – A Premature Retrospective

We may have been lucky once again. The H1N1 / Swine flu epidemic which was first reported in Mexico in 2009 hasn't proved as deadly as early reports suggested it might be. It's influenza. It's a pandemic. It will kill a lot of people over the next three years. But it doesn't look like it will be anywhere near as deadly as the flu pandemic of 1918. It looks like it is another near miss, which means that we may have the chance to learn some lessons from the current outbreak...

The outbreak of H1N1 in Mexico City in March 2009 looked deadly. By April 30th 2600 suspected cases had been reported and over 100 were reported to have died. On April 29th the World Healthy Organization had raised its pandemic alert level to phase 5 – indicating that we should prepare for a worldwide pandemic. Things looked grim.

But they weren't. The strain of flu turned out to be much less lethal than first thought – about the same or less than normal seasonal flu. When the WHO declared that the outbreak had reached pandemic status on June 6, it was almost a non-event.

It's worth spending some time on just why this happened, because it is very likely that this delay in determining the clinical attack rate (percentage of people exposed to the disease who develop symptoms) and mortality (percentage of people who die after catching the disease) and thus uncertainty about the danger posed by a disease will be repeated in future. Next time the authorities may err on the side of delaying or downplaying a pandemic: they may or may not be right when they do.

One of my wife's friends is a nurse is in the emergency department of a hospital. When we discuss childhood activities with her she has (to our minds) a very distorted view of their dangers. She sees a large number of children who have injured themselves while doing martial arts, tobogganing, or skiing so she sees these activities as excessively dangerous. She doesn't see the children who successfully climb a tree: only those who fall.

With pandemic flu there is the same problem. A hospital sees only severe cases. The tests required to determine the actual attack rate and mortality of a flu virus need to know how many people were exposed to the virus even though they did not develop severe symptoms. This is normally determined (in retrospect) by examining a sample of the population to determine how many have antibodies to the virus and have therefore been exposed to the disease. It takes time to do this. In the meantime, the only statistics available are the number of people with the virus arriving at the hospital and the number of people dying of the disease.

There's also a problem with testing. Suppose someone dies at the hospital of pneumonia. We do some tests to see if they had H1N1 flu when they developed pneumonia. They did. What was the cause of death? H1N1 flu. But if we hadn't been specifically looking for H1N1 flu, the death would have been ascribed to pneumonia. By testing, we start moving deaths and illnesses into the H1N1 column.

So our luck has held so far. The flu is spreading. It is a pandemic. It will kill people. If history is any guide, it will spread and kill a lot of people over the next three years. But it does not appear to be a deadly pandemic like that of 1918.

I classify this as a near miss. The good side of near misses is that we get to learn from them for the future. What can we learn so far?

What we can learn about pandemics and the world?

Let's take a look at some of the aspects of the 2009 H1N1 (Swine) Flu outbreak which may not have been obvious beforehand:

Flu spreads quickly. Between the first media reports outside Mexico and a WHO Phase 5 pandemic warning took about a month. The virus was reported in over 40 countries in a matter of weeks, and most attempts to stop the international spread of the virus were abandoned. Influenza is infectious before symptoms are visible, and, if it is capable of human-to-human transmission, its spread is only really limited by the availability of new people to infect.
Widespread economic effects. Places where people might gather were shutdown in Mexico City (from churches to restaurants) and all non-essential businesses closed for a period of time. Schools closed in other countries where a single student might have been exposed to the flu. In Hong Kong a hotel with 300 guests was quarantined for a week because a guest had the flu. The Mexican tourist industry shut down, with flights being cancelled and cruise ships being diverted.
International trade and travel affected. Contrary to WHO recommendations, pigs and pig products that originated in countries where the swine flu was detected were banned. Students from Canada visiting a province in China were (ineffectively) put into involuntary quarantine. Flights to some destinations are being checked for sick passengers, and passengers are being temporarily detained if it is believed that a passenger might have influenza.
Antivirals such as Oseltamivir (Tamiflu) worked on this strain but did not work on last year's seasonal flu. We can't rely on such drugs to be effective in a future flu epidemic.
The WHO Pandemic Phases don't take account of mortality. Seasonal flu is in Pandemic Phase 6, kills a few hundred thousand people each year, (mostly those with compromised immune systems), but is not something we worry about. Concentrating too much on the pandemic alert phase may give us a distorted picture.
Contractors with flu can't afford to stay home. It has been reported that the herd of pigs in Canada that caught Swine Flu may have done so from a contract carpenter who did his job even though he had some flu symptoms. If you don't turn up, you don't get paid. Welcome to one of the side-effects of the new economy.
People panic. Did you notice the underlying atmosphere of panic among the less informed? While models may predict the number of staff who will be killed, get sick, or take time off to look after a sick family member, it's unlikely that models will accurately predict the number who are absent due to fear of infection. You can get a good idea of the misinformation being propagated and some highly dubious products being promoted to panicked individuals by doing a search on Twitter (http://search.twitter.com/search?q=pandemic ).

What we can learn about our own readiness?

Now is the time to start reviewing what happened with our own pandemic preparedness while memories are fresh:

Did you activate you pandemic contingency plan? When did you activate it? Did you know how to activate it? Were you reviewing the possibility of a pandemic frequently enough to react before the first news reports started appearing?
Did you remind staff of the importance of basic hygiene? That the best ways to avoid getting and transmitting the flu virus are frequent hand-washing, coughing into a sleeve rather than a hand, and staying at home if you feel sick?
Did you increase the disinfection of common work areas?
Did you make sterilizing hand-cleaner available?
Did you make sure your staff had a reliable source of information, rather than relying on rumor and gossip?
Did you have a method of increasing social distancing? Were you ready (or did you) to switch to telecommuting? Did you start using teleconferencing? Or were you assuming that you had more time to buy equipment, train staff, etc.
Did you limit staff travel to / from affected areas? Did you restrict visitors?
Were you ready to institute split-shifting or other techniques to increase social distancing between groups of staff?
Did you have enough stocks on hand to cope with possible disruptions to supply?
Were you prepared for any possible restrictions on international trade or travel?

And finally…

Have you seen the complacent "it didn't kill us so everybody is making a fuss over flu pandemics for nothing" attitude yet? You will.

Comments

[You can comment on this article at the Risky Thinking blog at http://blog.riskythinking.com/ ]

Some Pandemic Reading

It's obviously too early for any sensible and considered publications about this pandemic. However, we can learn a lot from books about previous pandemics. Here are three favorites:

The Great Influenza: The Story of the Deadliest Plague in History, by John M. Barry, Viking, 2004.

This is the definitive history of the 1918 flu. If you want to understand what happened and why you need to read this. Barry gives a detailed and meticulously-researched history of the epidemic, from its initial outbreak in Kansas to its spread to every country in the world. Particularly startling are the explanations of the historical context: America was in a state of war and free speech (if it could be construed as being encouraging to the enemy or damaging to morale) was widely suppressed.

As well as the history, Barry gives excellent explanations of how flu spreads and why it spreads so rapidly, as well as how this flu variant killed, often within hours of the onset of symptoms. (If you imagine that flu is always a a headache, sore throat, and achy muscles, and that being killed by a flu pandemic might be a pleasant death, you really need to read Part IV of this book!)

More information: http://www.riskythinking.com/isbn/0670894737

Flu : The Story of the Great Influenza Pandemic of 1918 and the Search for the Virus That Caused it, by Gina Kolata, Simon & Schuster, 1999

Although this is intended to be a book about the 1918 flu epidemic, its real strength is in its coverage of the swine flu scare in America in 1976. An outbreak of flu at Fort Dix had similarities to the 1918 outbreak which killed millions. It killed a number of young soldiers and there appeared to be no immunity to it for people under the age of 50. Plans were drawn up to vaccinate all Americans, and a legal and litigation nightmare ensued. If you want to find out some of the reasons why the authorities reacted to this outbreak the way the did, read this book.

More information: http://www.riskythinking.com/isbn/0743203984

The Great Plague, by Stephen Porter, Sutton Publishing, 2003

There have been a number of plagues in history, but when English-speaking people refer to The Great Plague they invariably mean the bubonic plague which struck England in 1665, killing more than 70,000 people in London alone.

Medicine may have changed (bubonic plague can be treated with antibiotics), but the attitudes of people and politicians haven't. Porter suggests people at the time would either (a) take no precautions whatsoever and live riotously, believing death inevitable, or (b) live in total seclusion, or (c) not become a total recluse, but take extreme care in public places, or (d) flee.

Monitoring Twitter in the early stages of this pandemic I could see evidence of all these reactions. News reports of school pupils being shunned or sent home because they had been to Mexico also reminded me of this book. Perhaps we can learn more about public reactions to expect in a modern pandemic by looking at a what happened during the Great Plague.

More information: http://www.riskythinking.com/isbn/0750932635

Not Quite a Word from Our Sponsor

A reminder that if you don't yet have your pandemic plan in place, you can get software to assist you with writing one. See http://www.riskythinking.com/bpps for more details.

News of The World

In this section we look at the interesting, the instructive, and the downright odd from the world of Business Continuity, Disaster Recovery, and Risk Management.

Scare Flu Spreads from Tabloids to the Broadsheets

The press coverage of the swine flu pandemic has ranged from the excessively alarmist to the totally apathetic. Some amusing parodies of swine flu coverage from the staff at the NewsBiscuit.

http://www.newsbiscuit.com/2009/04/29/scare-flu-spreads-from-tabloids-to-the-broadsheets/

On the WHO announcement of Pandemic Phase 6

http://www.newsbiscuit.com/2009/04/29/scare-flu-spreads-from-tabloids-to-the-broadsheets/

If you want to get more scared about things, ask a lawyer

Some serious words by Kenneth W. Taber, a litigation lawyer, on the problems companies may face dealing with employees during an epidemic. What happens if you bar someone who is apparently healthy from work? Of compel a fearful employee to attend work? Will distributing anti-virals to employees land in you in trouble? Do you need health records?

Sadly the article is more of a promotional piece for the legal profession than a serious attempt to answer these questions. It raises questions, then suggests you get your lawyer to answer them. Worth reading, none the less.

http://www.contingencyplanning.com/articles/71866/

More Swine Flu News...

Researchers in Denmark have found Tamiflu-resistant strains of H1N1 emerging. RNA viruses such as influenza mutate very rapidly. This is why the outbreak of H1N1 remains a major concern, even though it currently has comparable lethality to seasonal flu. Note that drugs like Tamiflu do not prevent flu, they simply interfere with the propagation of the virus in an infected person and thus potentially reduce the severity and duration of the symptoms.
http://news.bbc.co.uk/2/hi/health/8124987.stm

UK authorities have finally admitted that the flu virus cannot be contained. (New cases may soon be running at 100,000 a day.) This means no longer performing lab tests to confirm the flu strain or giving anti-flu drugs to close contacts of infected people. This was to be expected. Flu is so effective at propagating that its spread is only really limited by the available population.
http://news.bbc.co.uk/2/hi/health/8130097.stm

Mathematical models developed by the CDC suggest that there have been about a million Americans infected with swine flu (so far) in the United States. This is actually good news. Hospitals and doctors only find out about severe cases, so if there are lots of people who have been infected and only a few hospitalizations, then a disease won't have a major impact. If the number of people infected is similar to the number of hospitalizations, then people getting the disease are likely to have serious complications.
http://www.nlm.nih.gov/medlineplus/news/fullstory_86096.html

It has been observed how effectively the 1918 epidemic spread before international air travel. The spread of a future virus was always expected to be quicker due to air travel. A study reported in the New England Journal of Medicine confirms this, relating the volume of air passengers from Mexico City during the early days of the outbreak to the location of cases in the months following the outbreak.
http://content.nejm.org/cgi/content/full/NEJMc0904559

Conflicker Worm: Forgotten but Not Gone

The Conflicker worm is still around, even if it isn't in the press. It is reportedly a very well written and thought out worm. You may remember the security warnings in March, the warnings that it might start doing things on April 1st, and the non-event when nothing happened. It is described in Wikipedia as the "largest computer worm infection since the 2003 SQL Slammer".

The concern has always been what it might be used for.

Between 7th April and 3 May, some copies downloaded a "spambot" (program which sends unwanted email), and a scareware program (program which attempts to scare users into buying a useless virus protection program).

So, rather mundanely, it looks like the authors of Conflicker are just in it for the money and presumably selling access to their web of compromised computers by the day.

Wikipedia information on Conflicker Worm:
http://en.wikipedia.org/wiki/Conflicker

Fire, Fire Everywhere

Fire is a major risk to any organization. Fire may occur almost anywhere:

In the cold of the Antarctic:
http://news.bbc.co.uk/2/hi/asia-pacific/8066991.stm

Another (older) fire in the Antarctic:
http://antarcticsun.usap.gov/features/contentHandler.cfm?id=1557

Or in an outside toilet:
http://www.firefightingnews.com/article-US.cfm?articleID=66400

Building work and welding torches remain a frequent cause of building fires. Sometimes fire alarm or fire suppression systems have to be disabled while the work takes place, increasing the amount of damage that a fire is likely to do. (Just heard an interesting talk given by someone whose company burned down during a holiday closure. The probably cause was a welding spark, and the fire alarm system had been disabled while building improvements were carried out. According to his insurers, this is a common pattern for serious fires).

10 Steps to Writing the Scariest Cyberwarfare Article Ever

My thanks to Bruce Schneier for drawing my attention to Evgeny Morozov's article on how to write a really scary cyberwarfare article.

http://neteffect.foreignpolicy.com/posts/2009/04/11/writing_the_scariest_article_about_cyberwarfare_in_10_easy_steps

Darwin Awards for Disaster Recovery

The Darwin Awards (http://www.darwinawards.com/darwin/) celebrate the attempts of the human race's less intelligent people to remove themselves from the gene pool. Along similar lines, Gary Audin has written an article on the Darwin Awards for Disaster Recovery. In an obvious attempt to get in early on a future Darwin Awards for Marketing, you need to agree to a complex terms of use agreement, a copyright agreement, and a personal privacy policy before you can see this article. You also need to agree to have your name, address, email, and phone number, as well as sundry marketing information sent to unspecified sponsors and partners of www.Webtorials.com.

This is a pity, as the article sounded like it might be quite fun. Your humble correspondent would have signed up and read the article, but couldn't afford the lawyer required to review the legal agreements, or the additional internet bandwidth or telephone line that might be required to receive communications from Webtorials unspecified sponsors or partners.

However, the editor of the Webtorials website does give some of the content away in this article:
http://www.networkworld.com/newsletters/frame/2009/061509wan1.html

Highlights apparently include:

A backup power generator which required electric pumps (not powered by the backup generator) to supply it with fuel.
Backup telephones for when the VoIP system failed located in an interior conference room without backup lighting.

If you with to sign a few legal agreements and receive more email, then the original article can be found at:
http://webtorials.com/abstracts/Delphi7.htm

Comments

You can comment on this newsletter on the Risky Thinking blog at
http://blog.RiskyThinking.com/ .

Administrivia

RISKY THINKING is a free newsletter providing essays, analysis, insights, and oddities related to Business Continuity, Disaster Recovery, and Risk Management. You can subscribe on the web at http://www.RiskyThinking.com/newsletter.

Please feel free to forward RISKY THINKING to colleagues or friends who will find it valuable. You may reprint this newsletter providing it is reprinted in its entirety.