Hurricane Sandy (aka “Superstorm Sandy”) wasn’t destined at the outset to go down in history as one of the greatest storms ever to hit the Northeast, but it has.

It evolved into an exceptionally large and devastating tropical cyclone that ravaged the Caribbean and the coastal Mid-Atlantic region of the United States in late October 2012. It was the largest Atlantic hurricane on record by diameter, with tropical-storm-force winds spanning 1,150 miles (1,850 km). The storm inflicted nearly US$70 billion in damage in 2012 dollars (equivalent to $96 billion in 2024) and killed 254 people in eight countries, from the Caribbean to Canada. The eighteenth named storm, the tenth hurricane, and the second major hurricane of the 2012 Atlantic hurricane season, Sandy was a Category 3 storm at its peak intensity when it made landfall in Cuba, though most of the damage it caused occurred after it became a Category 1 off the coast of the Northeastern United States.

Pause and Consider This Storm’s Unique Aspects

It is important to pause for a moment and consider some of the unique aspects of this event, a hurricane filled with superlatives:

• Deadliest and most destructive storm of the 2012 Atlantic hurricane season.
• Second-costliest hurricane in United States history, with preliminary estimates at $75 billion.
  • Katrina (2005, $81 billion USD). The largest Atlantic hurricane on record by diameter, with winds spanning 1,100 miles from Florida to Canada.
• A third of the country was affected by the storm, affecting 24 states.
  • Thousands of homes and businesses were destroyed.
  • Millions were without electrical power.
  • Killed at least 285 people along the path of the storm in seven countries. 72 of those deaths in the United States.
• Caused the cancellation of more than 13,000 flights across the U.S. on October 29: more than 3,500 additional flights on October 30.
  • Total number of flights canceled, 19,729.
  • Public transportation halted throughout the region.
• The New York Stock Exchange closed for two days.

“Routine Emergency” versus “Crisis Emergency”

Before delving into the lessons learned, it is important to pause and reflect on what set this storm apart from previous storms, beyond impressive statistics. To understand this, we need to examine the difference between “routine emergencies” and “crisis emergencies.” This concept was developed by two Harvard professors, Arnold Howitt and Herman “Dutch” Leonard, and serves as a helpful tool for planners.

A “routine emergency” doesn’t mean it isn’t challenging; it certainly isn’t easy. It is the type of emergency in our risk profile; in other words, it is expected, we have plans to accommodate it, and we train and exercise to manage it. It is its familiarity that makes it “routine.”

So, if hurricanes fit the Northeast’s risk profile, what sets this one apart? Sandy was indeed the classic definition of a “crisis emergency” – an event marked by significant novelty. It was an emergency unlike any previously experienced. Although the forces themselves were not new, their combination was challenging. Parts of it were familiar, but the flooding occurred at unprecedented speed. Existing plans were completely inadequate, and training and exercises had not accounted for the magnitude and sheer number of events. Leaders had to improvise new approaches to manage the incident. Sandy was the perfect example of a “crisis emergency.”

A crisis requires a different approach. First, leaders must determine the novelty of the elements. What is different about this situation? How does it differ from our current plans and processes? Once the differences are clear, leaders must then improvise response measures to address the unanticipated aspects of the event.

This often makes leaders uncomfortable, as they are deviating from plans and moving into uncharted waters. These actions, however, are born out of necessity, and in some cases, the actions and responses may be quite different from anything they have done before. For example, the Peer 1 data center in Lower Manhattan kept its data center online after the storm by forming a “bucket brigade” of staff and customers who manually transported diesel fuel up 17 stories from the street to the rooftop generator. That response was creative, and the team was extremely adaptable in executing an improvised solution.

Cognitive Bias

Many businesses that failed to take the threat seriously found themselves playing catch-up in the final hours before the storm hit. I heard from several clients and colleagues, “We got ready for Irene and nothing happened!” and “Our BCPs will be just fine.” Those people downplayed the possibility of a direct hit and serious flooding because a storm of this size “had never happened before.”

In these cases, a dangerous element was at play: cognitive bias. Cognitive bias is the persistent force that shapes people’s thinking and organizational awareness. Some refer to it as “faulty thinking.” Many cognitive biases appear in crisis situations. Here are just a few to consider:

• Overweighing one’s experience. (“Been there, done that.”) I have seen this often with clients who have gone through repeated events and think they have seen it all.
• The illusion of experience. A tendency for individuals to believe they have more experience than they actually do. They inflate their self-worth and knowledge.
• Overconfidence, both in one’s abilities and in one’s ability to predict the future. This results in overconfidence and a belief that one can actually control the future.
• Failure to observe or believe disconfirming evidence. “It’s really not happening”… even as water is rushing into the building.
• Escalation of commitment. Once it is noticed that the solution is not working, people recommit to that same solution, a “doubling down,” if you will.
• Migration of objectives. Objectives shift and become personal; they lose focus and meaning.

Storm Approaching

Sandy began her life on October 22 as a tropical wave when the storm first formed. She then began her march through the Caribbean islands: Haiti, the Dominican Republic, Cuba, the Bahamas, and Jamaica. By October 25, all eyes were on Sandy, and speculation and hedging began. She was skirting the Eastern Seaboard, and the question was whether she would turn west and move inland. Initially, European computer forecast models predicted the storm would strike the Northeast, while most others anticipated it would move out to sea. These differences created some confusion and perhaps led some business continuity managers to think they would dodge a bullet. There was widespread disbelief and discounting among weather pundits.

Many people were asking whether this storm would “be like Irene.” (You might recall that Hurricane Irene was forecast to hit the Northeast hard, yet the damage turned out to be more modest in the populated areas.) Several clients and colleagues reiterated that they had prepared for Irene and nothing happened. There seemed to be a belief that a certain amount of “crying wolf” was going on.

The Storm and Its Aftermath: Five Categories to Explore

To fully understand the storm and its aftermath, it is helpful to break the discussion into five basic categories: People, Facilities, Technology, Incident Management and Business Continuity Plans, and Communication.

People

Widespread power and communication outages, road damage, airline and mass transit closures, and shortages of gasoline and supplies (food, emergency supplies, water, and first aid) all had a huge impact on people and their ability to respond. We all know that without our staff, we have no business to recover.

So, where do we begin? Personal, family, and home preparedness is essential. If your employees aren’t prepared at home, they won’t be able to help you restore your business. During Hurricane Sandy, many lacked even the most basic supplies at home, such as flashlights, batteries, food, and first-aid supplies. It is in your best interest to promote preparedness among all your staff. The FEMA Ready.gov website offers excellent resources to educate and promote personal readiness.

What do you do when employees need assistance? Many East Coast employees lost their homes, sustained major damage, or had no heat or power and needed a place to stay. Many companies had never considered that when their employees needed help during a disaster, they would look to the employer for that assistance. Companies scrambled to develop policies and procedures for employee support, loans, and other forms of assistance. Some even had staff and families spend numerous nights in their facility because it had heat, water, and electricity.

What will you do to help your employees? Don’t wait until the next disaster – think about these things now and develop a plan.

Facilities

Many companies had more than one facility affected because the storm covered a wide swath. When those companies turned to their business continuity plans, they encountered immediate problems.

Work from Home

Those who relied on working from home as their primary recovery strategy came up short. The widespread power outages caused by a 1,110-mile-wide storm were unprecedented. Many of these outages lasted for days. Due to the storm’s reach, it was difficult for employees to travel even a reasonable distance to find power and work. This was due to major power outages across a wide area, transportation difficulties (mass transit, canceled flights, road damage, and gasoline shortages), and, in some cases, damage to employees’ homes. This slowed recovery.

Damage at Multiple Locations

Many large companies in the East have multiple nearby locations. Upon examination of their BCPs, many found that their designated backup site was too close to their primary site. This left many companies scrambling when both their primary and backup facilities were unavailable.

Untested Recovery Strategies

One common strategy I hear companies want to implement is “employee displacement.” Simply put, remove a “non-critical” employee, “displace” them, and seat a “critical” employee at their desk. Sounds great, right? Save money by using the space that’s already there and the equipment on the desk? Well, yes and no. What happens to those who are displaced? Do they get sent home on paid vacation while others toil away? Most people in times of emergency want to work and be part of the recovery, even if they are not in a “critical” position. And what about the equipment? Does the displaced staff member’s computer have the necessary applications and capabilities for the critical employee? Are there special phone needs, such as recording ability or VRU? If you have this strategy in your plan and have never tested it, beware! You are likely to encounter many issues when you try to implement it – it may not be the quick-and-easy solution you think it is.

“Follow the Sun”

Many global companies include in their BCPs that they will “transfer the book of business” to another company location during a disaster. A great idea! However, this requires careful planning, along with well-documented processes and exercises to ensure success. Some companies were caught flat-footed by untested “follow the sun” recovery plans.

Technology

Issues with technology occurred on two fronts: (1) widespread infrastructure damage in the region affecting both utility and communications providers, and (2) companies that suffered technology damage during the storm and its aftermath. I can’t help but think of a company that had both – the Verizon building in Lower Manhattan. A security camera captured images of their 140 West Street main lobby at the height of the storm surge, and they went viral on the Web. The building’s five-level basement was submerged, and water was over three feet high in the main lobby. Numerous other data centers in Lower Manhattan also suffered outages, some due to flooding and others because they ran out of diesel fuel.

This is a great opportunity to review the risks facing your company’s technology centers. Do you have adequate plans aligned with your risk profile? If flooding is a risk, do you have sandbags and pumps on site? Do you have at least two diesel fuel providers under contract? If you must “abandon ship,” what are your recovery strategies? If you are using a third-party vendor (think cloud computing), what is their disaster recovery plan?

Many employees who lost power at home not only lost the ability to power their devices; they also lost their internet connections. Scenes of employees standing in a charging line at coffee shops were common. This also threw a monkey wrench into those work-from-home BCPs. Helpful solutions to get some power include solar chargers for phones and laptops, and electrical converters that can be plugged into your car’s cigarette lighter – both can provide some immediate power and relief. (After living in earthquake country, I always keep a converter in my car, and my gas tank is always at least half full.)

If all else fails, do you have your most critical information on real, live paper? Sounds old-fashioned, I suppose, but many people in the East were hard-pressed to contact people after their phones died. Not only was the device no longer useful, but without power, they also lost access to all their phone numbers. (Thanks to AI, many people no longer memorize phone numbers – just give the name of a person and the phone dials the number) Keeping critical phone numbers, account information, and other important data in a paper format is incredibly helpful.

Crisis Management and Business Continuity Plans

Crisis Management Teams (CMT) and plans were put to the test. For example, many CMT plans are silent on who should conduct an incident assessment, how and where the team will meet, and what criteria are used to “declare.” Furthermore, this process is not often exercised. I witnessed companies that had not really worked this out in advance fall to their knees, desperately trying to make it up on the fly.

Another key tool of an CMT plan is the ability to develop an incident action plan (IAP) and then communicate their plans and actions to all key stakeholders. Again, an IAP is one of those actions that require practice to hone thinking and skills. For those who had not exercised the process, they ended up going in many directions simultaneously, like a headless chicken (at least initially), and without a great deal of success.

There was one core flaw in many BCPs we reviewed. There was an overwhelming assumption that companies would be out of their facility for only a short period of time, after which everyone could go back to work. This was coupled with the major assumption that employees could work from home. A double whammy!

A case of extreme criticality was the four New York City hospitals that were forced to evacuate patients as water poured in and power failed. Those hospitals (NYU Langone Medical Center, Bellevue, the Manhattan VA hospitals (all next door to one another along the East River), and Coney Island Hospital in Brooklyn) had to relocate more than 1,200 patients. Many of us watched with bated breath as four newborns in the NYU Neonatal ICU on respirators were carried down nine flights of stairs while a nurse manually squeezed a bag to deliver air to the babies’ lungs. The good news about those evacuations is that none of the patients had adverse effects.

Communication

Twitter was the true spokesperson of the day during Hurricane Sandy. If you wanted to know what was really going on, all you had to do was follow Twitter. The social media service provider really shined during Sandy. It gave people on the street the opportunity to post real-time information, pictures, and videos of events happening right at that moment. It allowed those in need to post requests for assistance, such as help with evacuation, and it allowed emergency responders and government officials to reach out with critical information to those who needed it the most. I don’t know if its latest iteration as X would be as helpful today.

There were, of course, some great fake tweets and posts on Facebook pages, but they were quickly called out. For example, the man who said the New York Stock Exchange was flooding was arrested for spreading false rumors on social media. There were also some great images, clearly Photoshopped, that provided a bit of necessary humor, like the image of the Statue of Liberty being bombarded by waves, taken from the movie “The Day After Tomorrow.”

Sandy clearly pointed out that we need multiple ways to reach our key stakeholders. If you have limited options, your communication performance is poor. It was a great reminder to diversify your communication approach.

Going Forward

There are many valuable lessons to learn from Hurricane Sandy, regardless of where you are in the country or the world. This is not about hurricane readiness; it is about planning and improvising when the plans don’t fit the disaster at hand. We have a great opportunity to learn from these mistakes and key findings and to do better next time. At times like this, it is good to remember the wise words attributed to Albert Einstein, who said, “Insanity is doing the same thing over and over again and expecting different results.” I vote for sanity!