Business Continuity Planning (BCP) and related IT Disaster Recovery Planning (IT DRP) have become established, respected and important disciplines in business. However, many of the assumptions underlying BCP/DRP planning today will NOT hold in a pandemic, writes technology risk expert Dr Patrick McConnell DBA MSc BSc GAICD CITP CEng FBCS.

The typical solutions, which essentially involve moving people away from compromised sites to ‘back up’ locations, just won’t work in a pandemic, such as with coronavirus COVID-19: it’s one virus that will not affect computer systems.

Instead, it will be people rather than infrastructure that will become unavailable. And it is the largest firms, with multiple overseas offices and highly centralised support functions, that will be most at risk from staff being unavailable for work.

In a pandemic, computer systems will continue to work, provided that key operational and maintenance staff have uninterrupted access to their control terminals. Telecommunication networks will continue to work - again, provided that network and security managers have the essential monitoring and control capabilities.

‘So, unlike other business continuity situations, where restoring technology is often the greatest problem to be overcome, in a pandemic, technology, especially telecommunications technology, will be the solution, not the problem.’

The nightly television pictures from the city of Wuhan in Hubei, China showed empty roadways and office buildings with most of the city’s 11 million people hunkered indoors under strict mandatory quarantine rules. But, in the first large epidemic since the development of mobile phones and social media, inhabitants in Wuhan were not completely ‘isolated’ but were able to communicate via apps with family, friends and importantly medical authorities. Apps such as WeChat, Weibo and WhatsApp not only allowed video communication but also provided access to online banking services and e-commerce, such as purchasing food. Remaining relatively safe at home has become a viable option in these extreme circumstances.

But what about work? How did firms in Wuhan survive, and how would your firm continue to operate if a large proportion of the staff were not ill, but could not get into work for an extended period?

The concept of ‘working from home’ on an infrequent or even regular basis has become the norm in many firms and especially in IT departments. With the advent of Outsourcing and now Cloud Computing, the notion of people ‘working remotely’ has become commonplace.

Thus, good telecommunications capabilities are key to firms continuing to operate in what will, if / when a full-scale pandemic is declared, be a prolonged disruption.

The COVID-2019 pandemic

Although the COVID-2019 coronavirus epidemic may not blow up into a full-scale global pandemic, it could be close. Pandemics are far from unique events. This century alone there have been numerous serious outbreaks of deadly virus-borne diseases: in 2003, the H5N1 Avian Influenza; in 2004, the Severe Acute Respiratory Syndrome (SARS) epidemic; the Middle East Respiratory Syndrome (MERS) epidemic of 2012 (which is still circulating); and the deadly Ebola virus outbreaks of 2014, which re-emerged in 2018.

Simply, these and similar diseases emerge when a virus that is circulating widely (but relatively benignly) in the animal kingdom jumps to infect a human in a random event. What happens at that point determines much of what follows: the infected human may fight off the virus and nothing untoward happens, until the next time a jump occurs. Or, the virus may kill the human before the virus jumps to another human, again causing no further occurrences.

It starts to become dangerous where one person infects another, who infects another and so on, until before long, the virus is in the general population. Some viruses such as Measles are more infectious than others, while some are less so. Unfortunately, some viruses, such as MERS, are more deadly to humans than others and people die from the viral infection.

So, the so-called mortality rate of a particular virus is important; a virus with a high infection rate and a high mortality rate can turn an epidemic that cannot be contained locally into one that grows into a worldwide pandemic with disastrous consequences. This occurred in the so-called Spanish Flu pandemic of 1918-1919, which killed more people than did the World War that preceded the outbreak.

While each epidemic is different, driven by the unique characteristics of the particular virus, there are things we do know about all pandemics:

Pandemics are inevitable!

Because the animal kingdom holds a huge reservoir of viruses that are potentially deadly to humans, it is only a matter of time and evolution before a virus mutates to a form that can ‘jump’ and infect humans. The more animals, the more humans and the more viruses, the more likely such an essentially random event will occur.

Some of these viruses will be infectious and will jump to other humans. Inevitably, some of the viruses will spread in the general population (an epidemic) and even may, with modern air travel, appear in different countries almost overnight – where again, the epidemic grows in local populations, becoming a pandemic as defined by the World Health Organization (WHO).

Pandemics are inevitable, but because a lot of things have to go right - for the virus that is - they are thankfully rare.

Pandemics are difficult to stop

It is very difficult to stop a virus outbreak, especially one where the virus is highly contagious. Because the initial symptoms are often similar to those of seasonal flu or common cold, novel viruses can circulate widely in the population before being detected by medical staff. There is often a period of extreme confusion before a new virus is identified and a good diagnostic test is developed. During this ‘onset’ phase, people will inevitably die. Rumours will abound and some of the public will panic.

One obvious way to slow a deadly virus spreading throughout a population, is to stop people infecting one another, which means isolating or ‘quarantining’ people who have been, or might be, infected. Isolating whole communities is a pretty big step for authorities to take - but, as the mandatory isolation measures in Wuhan showed at the beginning of the latest virus epidemic, it can be pretty effective. However, isolation does not kill the virus, it merely slows down the rate of infection through the community.

What is needed is a vaccine specially designed to recognise and kill the particular virus, without killing the person who is carrying it. The experts in viruses, virologists and microbiologists, know how to do this - but it takes time. And, from first identifying a new viral strain to getting an effective vaccine to the majority of the population will take many months.

For that period, quarantine is the only effective mechanism for treating a pandemic. People must stay isolated, at home or elsewhere, possibly for many months.

How long will a pandemic last?

No one knows precisely how a pandemic might unfold. However, the three influenza pandemics of the 20th century give some clues as to what might be expected. Figure 1 shows a rough timeline of how a pandemic might evolve, illustrating the scale of disruption and the highly uncertain time taken by each phase.