The George Washington University Institute for Crisis, Disaster, and Risk Management

The Survivals of eCommerce Systems After the WTC Attacks

John R. Harrald, Ph.D.

Youn Hee Kim, M.S.Institute for Crisis, Disaster, and Risk Management

The George Washington University

Supported by NSF Grant CMS 0219953

The George Washington University Institute for Crisis, Disaster, and Risk Management

Contents

• Project overview• Research method• eCommerce system recovery overview at WTC• Technology for surviving• Future research tasks

The George Washington University Institute for Crisis, Disaster, and Risk Management

September 11, 2001

The George Washington University Institute for Crisis, Disaster, and Risk Management

September 11, 2001• 19 terrorists hijacked 4 aircraft for suicide attacks• Almost 3000 people killed• In Manhattan: - 34.5 million ft2 office space lost

- $50-70 billion in insured losses• Most of these direct economic losses were

incurred by the private sector

The George Washington University Institute for Crisis, Disaster, and Risk Management

Terrorist Groups are Targeting U.S. and World Economy

“The settlement of this overburdened account will indeed be heavy. We will also aim to continue, by permission of Allah, the destruction of the American economy.”

Ayman Al-Zawahiri, head of Al-Qaeda operational planning(6 October, 2002)

The George Washington University Institute for Crisis, Disaster, and Risk Management

Project overview

• National Science Foundation Funded the study: Financial and Strategic impacts of the attacks on large publicly held corporations.

• Project consists of three sections– Section 1: Organizational strategies for coping with extreme events– Sections 2: System recovery from extreme events– Section 3: Defining of a common body of knowledge for

executive level crisis managements of extreme events

The George Washington University Institute for Crisis, Disaster, and Risk Management

Research method

• Select target companies out of 330 companies in WTC• Compare the financial performance for 18 months by

using stock price.• Conduct personal interviews and surveys to CEOs,

CIOs and other executive officers and technical personnel

• Analyze data and compare the result of three sections

The George Washington University Institute for Crisis, Disaster, and Risk Management

Selection of Companies

www.tenantwise.com

GOAL: To sort through the thousands of companies that had been directly affected by the attacks in order to formulate a list of 20 and 25 companies to be studied

The George Washington University Institute for Crisis, Disaster, and Risk Management

Results • Company 30, Fast Recovery Example

The George Washington University Institute for Crisis, Disaster, and Risk Management

Results Company 33, Non-Recovery Example

The George Washington University Institute for Crisis, Disaster, and Risk Management

Results

Ranked Average change in Stock price between 9/11/2001 & 3/11/2003

The George Washington University Institute for Crisis, Disaster, and Risk Management

Research method for the section 2: system recovery from

extreme events

The George Washington University Institute for Crisis, Disaster, and Risk Management

eCommerce system recovery overview at WTC

• Merrill Lynch, one of the largest investment firm– Number of employees lost : 3 – Amount of office space lost: 2,083,555– Physical location affected: 4 World Financial Center,

Whole Building – 2002 revenue: $28.5billion– Headquarters: 4 World Financial Center, New York, NY

10080

The George Washington University Institute for Crisis, Disaster, and Risk Management

eCommerce system recovery overview at WTC

• Merrill Lynch, one of the largest investment firm– Returned back to work within 24hours

– Transferring trading operations to London, Tokyo and Hong Kong

– Used their web site to communicate relocation and emergency transportation information to employees

The George Washington University Institute for Crisis, Disaster, and Risk Management

Merrill Lynch stock performance

The George Washington University Institute for Crisis, Disaster, and Risk Management

eCommerce system recovery overview at WTC

• Citigroup– Number of employees lost: 3– Amount of office space lost : 7 WTC (7 WTCwas leased to Citicorp)– 2002 net income before taxes: $ 20.537 billion– Headquarters: Citigroup Inc. 399 Park

Avenue, New York, NY, 10043

The George Washington University Institute for Crisis, Disaster, and Risk Management

eCommerce system recovery overview at WTC

• Citigroup– Returned back to work within 24 hours– Transferred Series of computer and backup

data to another branches (as far as London)– Obtain a spare office location for emergency

use

The George Washington University Institute for Crisis, Disaster, and Risk Management

eCommerce system recovery overview at WTC

• Marsh & McLennan Cos.– Number of employees: 295 (mostly, IT staffs)

– Amount of office space lost: 600,000 sq.ft. (North Tower, Floors 93-100 )

– 2002 revenue: $10.4 billion

– Headquarters: 1166 Avenue of the Americas, New York City, NY

The George Washington University Institute for Crisis, Disaster, and Risk Management

eCommerce system recovery overview at WTC

• Marsh & McLennan Cos.– Came back to work few days after the attack

– Using the international structure, the firm quickly pulled lost data from other locations

– Relocated workers to New Jersey and Pennsylvania within 7-10 days

The George Washington University Institute for Crisis, Disaster, and Risk Management

Marsh & McLennan stock performance

The George Washington University Institute for Crisis, Disaster, and Risk Management

eCommerce system recovery overview at WTC

• NYBOT(New York Board Of Trade)– Parent company of coffee, sugar and cocoa

exchange Inc.(CSCE) and the New York Cotton Exchange (NYCE).

– Lost its primary trading facility in WTC– Lost the main trading machines in WTC

The George Washington University Institute for Crisis, Disaster, and Risk Management

eCommerce system recovery overview at WTC

• NYBOT(New York Board Of Trade)– Returned back to the normal situation after 7 days

(Monday, Sept. 17th)– Prepared the hot site with Comdisco (commercial

disaster recovery service bureau in 1993, $300,000 maintain cost/year)

– Adding 700 phone line and 20 T-1 to the hot site and run the business.

The George Washington University Institute for Crisis, Disaster, and Risk Management

Critical Success Factors

• Preparedness– Intensive preparation after the WTC

bombing in 1993• NYBOT: started to build the hot site in 1995• AON: prepared disaster recovery plan

– Y2K preparation• Merrill Lynch: prepare the data center for

the computer malfunctions.

The George Washington University Institute for Crisis, Disaster, and Risk Management

Critical Success Factors

• Action– Rapid decision making procedures

• Marsh and McLennan: rapidly decided the office relocations and

– Knowledgeable technical staffs and vendor's supports

• NYBOT: added the phone line and T-1 lines within one day with vendor’s quick supports.

The George Washington University Institute for Crisis, Disaster, and Risk Management

Technology for surviving

• Mirroring (data shadowing)– Merrill Lynch used this technology to protect

critical data as a part of their Y2K preparation – Many e-commerce companies use this technique to

transfer the important data– Version and IBM start to service the rerouting

calls service from a damaged office to another location

The George Washington University Institute for Crisis, Disaster, and Risk Management

Technology for surviving

• Clustering/zoning– Isolation technique to prevent localized failure impacting

the entire storage system.

• Wireless technology– NOBOT: distributed 200 cells to trader after the attack– After the attack, many companies consider wireless

network service options for reliable data communications.

The George Washington University Institute for Crisis, Disaster, and Risk Management

Technology for surviving

• Data redundancy– Successfully recovered companies had a redundancy

data (customer records, transactions records) in other locations.

– Hot site and cold site is also part of redundancy strategies.

– Doing regular data/log back up and save them to multiple places are the key.

The George Washington University Institute for Crisis, Disaster, and Risk Management

Next Tasks

Determine what caused discrepancies between the outliers, and confirm our findings regarding market absorption of financial loss,

Investigate strategic impact on corporations not directly impacted by WTC attack and compare with sample companies.

Interviews, surveys will investigate specific eCommerce issues

The George Washington University Institute for Crisis, Disaster, and Risk Management

What wasin place?

What wasimprovised?

How wasit used?

How did it work?

What waslearned?

What was modified orchanged?

Framework for Analysis of Strategic Impacts

Revised Corporate Strategy

Investments in preparedness

The George Washington University Institute for Crisis, Disaster, and Risk Management

Expected ResultsUnique evaluation of financial impacts of WTC attacks on large corporations.

Evaluation of corporate preparedness, disaster recovery and business continuity strategies procedures, and technology.

Evaluation of survival techniques andTechnologies for eCommerce

Better understanding of impact of extreme eventsevents on corporate strategy, plans, & investment

The George Washington University Institute for Crisis, Disaster, and Risk Management

Questions?

For additional information contact John R. Harrald at jharrald@gwu.edu (202) 994-7153www.gwu.edu/~icdrm