The survival brief

The cataclysmic events that devastated New York's World Trade Centre on11 September have inevitably prompted law firms to review their disaster recovery plans.However, as Robert McAfee, director of administration at City giant Norton Rose, warns: 'It is a truism to say no plan survives first contact with the enemy.

The most detailed plan can be reduced to confetti depending on what happens - and what happened in New York and Washington was really beyond anybody's ability to prepare.'We have lived with the threat of violence for so long it has become a daily part of life in London, but nothing would be a defence against the events in America.'The terrorist attack brought back painful memories for staff at Norton Rose, which was bombed out of its offices on 24 April 1993 when the IRA's Bishopsgate bomb exploded, killing one person, injuring 44, and causing hundreds of millions of pounds worth of damage.Mr McAfee says: 'Fortunately, we didn't suffer any loss of life, and there is no comparison with the scale of the tragedy in New York and Washington.

I wasn't with the firm at the time but it must have brought back memories for those who were.'He explains that after the Bishopsgate bomb, the firm's office was uninhabitable.

'But we were able to move into temporary accommodation and within 48 hours we had something together and were back working'.

However, with the increasing sophistication of IT systems and the firm's growing dependency on a multiplicity of applications, he says: 'It would be a much more difficult proposition to move and set up again so quickly.'Several law firms had offices in the World Trade Centre and all were back working within a week.

The largest, top five US practice Sidley Austin Brown & Wood, with 600 employees in the World Trade Centre, has one member of staff still unaccounted for.

The firm immediately arranged counselling for all New York personnel and their families, many of whom lost family and friends.It leased four additional floors in its midtown office.

In a letter on its Web site to 'colleagues, clients and friends', its management committee explains: 'Our technological support has always included disaster recovery for all aspects of critical information - client data, financial and payroll records and all of the ancillary items which a global law firm requires.'Harris Beach & Wilcox, which had 113 employees in offices on the 85th floor, lost five members of staff.

Thanks to the generosity of a client, they were able to re-establish themselves in a midtown office.Mr McAfee says: 'We tend to think of disaster recovery in three stages.

Stage one is the survival plan - how do you try to ensure the safety of staff?'The next stage is to assemble the "A team" - to get the key players together in a control point where they can make a risk assessment, direct recovery operations and begin to re-establish the business.

We are fortunate in having a split site, spread over a number of buildings.

First port of call would be one of the offices furthest from the point of impact.'We also have mutual assistance arrangements with other law firms to provide each other with emergency accommodation.'The third stage is business continuity, he explains: 'Finding new premises is relatively straightforward.

It is more difficult to re-establish IT systems, although we back up the information every night, which is kept off site.'He says there are a number of options firms can adopt.

'You can go for an in-house duplication model [a self-made back-up system].

The second option is to outsource this to a disaster recovery site.

But that is finite - if the disaster area is great, you won't be able to guarantee first call on such a facility.

Also, to what extent can it be tailored to suit your IT system? Some banks have shadow sites - big warehouses with hundreds of desks and PCs, but that is big bucks.'Each of Freshfields Bruckhaus Deringer's offices has its own disaster recovery plan.

Chief operating officer Kirk Stephenson says: 'For example in London, we have an off-site facility should there be any problem with the IT systems in our central offices.

We also have various procedures in place for confirming the whereabouts of staff in an emergency - whether during or out of working hours.'However, we know that our systems are not perfect, and we will be reviewing them carefully over coming months in light of the recent events in the US.'Nick Cray, Lovells' chief operating officer, says: 'Like everyone else, we are thinking - have we got all the bases covered? But the scale of the attack was just so staggering.'Our office in New York is in midtown, and far enough away not to have been physically touched, but the team there is personally affected.

One of the unforeseen difficulties was the extensive telephone problems.

Cable & Wireless also turned off the wide area network link - which carries electronic communications such as email - to make sure it wasn't interfering with the emergency services, and then were unable to get back into the area to turn it on again for several days, which hit our communications between the US and UK and meant we had to find another way of sending e-mails.'Mr Cray says Lovells has ten staff on its London disaster recovery team, including senior management from the communications, technology and facilities departments.'The first concern is always your staff and their safety.

We have a cascade system for contacting staff.

People on the disaster recovery team have lists of everyone's contact details.

We would initiate calls, for instance, then practice area partners would contact everyone in their group.

The next step is ensuring communications are up and running.'The biggest problem is losing paper-based files, Mr Cray explains.

'You can back up your computer systems every day and keep that off site but you can't back up all your paper.

As far as possible we have duplicate systems but we don't yet have everything scanned.

Like most people, we don't yet have a paperless office.'We have a disaster recovery site with computers and a limited number of desks.

We bring the systems back up to test them, including our accounting records - we have proved those facilities and we test them every six months.'Mr Cray explains that it is up to each of Lovells' international offices to review security procedures locally - it is not feasible to plan everything centrally.However, he adds: 'We have been through a period of significant international growth, so we are reviewing those plans to make sure that we have got communications sorted out and all technology backed up off site.'Malcolm Ross is crisis management consultant with Worcestershire-based Focus Training, which advises on all aspects of in-house investigative techniques against fraud and disaster management.

'The aim is to reduce the amount of time your business is interrupted.

And the key to a successful business continuity plan is planning, preparation, practising and training so when the wheel comes off people do know what to do.

Whoever is in charge must be sufficiently senior to be able to allocate resources, staff and training time.

Good recovery procedures cost money.'The US attacks underlined the need to plan for the unbelievable.

Mr Ross adds: 'If you don't, you are going to be caught out and your business put at risk.'The disaster threw up all sorts of problems, including employees who fled hotels and offices and were left stranded in New York with no identification.

Julia Onslow-Cole, head of the immigration team at CMS Cameron McKenna, points out that her firm was inundated with requests for help.She says: 'The lesson firms should learn from this is the importance of keeping personnel records of employees working overseas in very good shape, with copies of birth certificates and other forms of identification.'While everyone's minds are understandably focused on terrorist attacks, natural disasters can also cause havoc.

There are already flood warnings for this autumn and winter, filling with trepidation those whose offices were flooded last November.Roger Dixon, senior partner of Hague & Dixon, works from the firm's Stamford Bridge office near York.

'For us, the Stamford Bridge flood in March 1999 took us by surprise as the area hadn't flooded more than once in the last century.

We didn't cope very well at all as we hadn't made any preparations.'But he explains that the inconvenience was minor compared with the flooding in November last year, which severely disrupted the firm's York office, which is an 18th century listed building.'After the 1980 floods [which also affected the York office], we were relatively sophisticated in having separate power circuits for the ground floor and upper floors.

But we still had to abandon the building and escape over the roof tops to avoid being trapped.

And because the water stayed so high for so long, the stench and filth was terrible - we aren't straight yet,' he adds.

'Now, we keep all sensitive documentation, such as wills and deeds, in the attic and we have re-sited the computers and telephone system on the upper floors.

We have a team of people who are responsible for keeping in touch with the Environment Agency and making sure we have an adequate supply of candles, camping stoves, waders, rubber gloves.

We also back up our computer data every night and keep it off-site.'But all the preparation in the world cannot provide total security: 'I feel as prepared as you can be, but anybody who thinks they are totally prepared is asking for trouble.

You may think you have all the angles covered but nature has a way of bringing you up smart.'Grania Langdon-Down is a freelance journalist