Disaster forecasting is required for businesses and communities.  Preparing for a disaster is the best way to survive it.  Accurately preparing for a disaster may also allow an organization to mitigate the problems that arise from the event.  FEMA and DHS provide a plethora of planning guides and guidance (DHS Science and Technology, 2020b; FEMA, 2021a, 2021b, 2021c) to help an entity plan for a disaster.  An infamous prediction that came true was the results of FEMA’s Hurricane Pam exercise, which closely and accurately predicted the events of Hurricane Katrina.  According to the National Hurricane Center, the greatest risk to life and property along the coasts are hurricane caused storm surge and large waves  (DHS Science and Technology, 2020a).  In order to better prepare for hurricanes, FEMA chose a vulnerable city to develop a better disaster plan and to recommend key infrastructure improvements.  Since New Orleans is a vulnerable coastal city, FEMA developed an exercise based on a model of a slow-moving Category 3 hurricane that had 120 mph winds at landfall.  The exercise was conducted from July 16 through July 23 in 2004, with over 300 local, State, and Federal emergency response officials.  The hurricane model was developed in coordination with NOAA and the National Hurricane Center (NHC). The contractor responsible for the exercise model (innovative Emergency Management, Inc.) tweaked the NOAA model slightly by ensuring that there was 20 inches of rain falling over the New Orleans area (U.S. Senate, 2006). Hurricane Katrina made landfall near New Orleans as a strong Category 3 on 28 August 2005, with 120 mile per hour winds (Medlin et al., 2016).  Table 1 below contrasts the model’s predictions and Hurricane Katrina’s actual impacts. 

Table 1

Comparison of Exercise Pam Model to Hurricane Katrina (U.S. Senate, 2006)

Predicted Event	Exercise Pam	Hurricane Katrina
Hurricane	Strong Category 3 (120 mph at landfall)	Strong Category 3 (120 mph at landfall)
Landfall	West of City	East of City
Rain	20 inches	18 inches
Overtopping Levees	Yes	Yes + Levee breaches
Louisiana Offshore Oil Port Closures	2 or 3 days after storm	5 days after storm
Oil Refinery Shutdown	9 shutdown	7 shutdown
Chemical Plants Flooded	57	50+ (disagreement on some site data)
Homeless after Storm	1.1 million	~1.0 million
Bridge Collapse	Leeville Bridge on Louisiana Highway 1 (west of city)	Twin Span bridge (east of city)
Electricity Loss	786,359 people	881,400 people
Debris Generated	12.5 million tons	22 million tons
Marsh Erosion	Extensive	~25 square miles
Sewage Treatment Plants	Not working	Not working
Destroyed Buildings	233,986	~250,000
Parish Hospitals	15 percent of the 13 parish hospitals	All destroyed
Damages	40 Billion	125 Billion
Deaths	61,290	~1700
Evacuation Percentage	36 percent (based on past hurricane evacuations)	~80 percent
Temporary Medical Operations Staging Area	3	3

 

Although there was not enough time between Exercise Pam and Hurricane Katrina to implement all of the exercise recommendations, a few items were implemented.  Because National Hurricane Center had participated in the exercise, they publicized Hurricane Katrina’s risks, and convinced many state and local officials to help evacuate as many people as possible.  NHC also convinced the news media to take the storm seriously and to convince people to evacuate.  In testimony before the Senate, officials believed that although Katrina had a tragic death count, it would have been far worse if the evacuation percentage was typical.  The Exercise Pam team also developed a novel concept for search and rescue evacuations, which was used in ~60,000 water rescues in Hurricane Katrina.  This approach was able to rescue more people than was typical (U.S. Senate, 2006). 

Another novel approach in the exercise was to use scientists, experts and engineers to create and model the disaster, then attempt to build the plan.  Previous approaches had designed a plan first, then tested it to some standard, that may or may not have been accurate.    I think this approach is what made the prediction so accurate.  I also think that since the model was as accurately modeled as possible, that the NHC was willing to publicize the storm, resulting in a lower death count.

 

 

References

 

DHS Science and Technology. (2020a). Hurricane Toolkit. https://www.ready.gov/sites/default/files/2020-04/ready_business_hurricane-toolkit.pdf

 

DHS Science and Technology. (2020b). Severe Wind and Tornado Toolkit. https://www.ready.gov/sites/default/files/2020-04/ready_business_severe-wind-tornado-toolkit.pdf

 

FEMA. (2021a). Business Continuity Plan. https://www.ready.gov/business-continuity-plan

 

FEMA. (2021b). Business Impact Analysis. https://www.ready.gov/business-impact-analysis

 

FEMA. (2021c). Space Weather. https://www.ready.gov/space-weather

 

Medlin, J., Ball, R., Beeler, G., Barry, M., Beaman, J., & Shepherd, D. (2016). Extremely Powerful Hurricane Katrina Leaves a Historic Mark on the Northern Gulf Coast. https://www.weather.gov/mob/katrina

 

U.S. Senate. (2006). Preparing for a catastrophe: The Hurricane Pam exercise. Senate Hearing 109-403. https://www.govinfo.gov/content/pkg/CHRG-109shrg26749/html/CHRG-109shrg26749.htm

 

 

 

Traditional forecasting predicts the future based on past historical information, has a short-term perspective, uses experts, is fact based, uses a theoretical model to predict the future, and does not factor in risks and uncertainties.  Forecasting plans for one future (Mortlock, 2021).  An excellent example of traditional forecasting is weather forecasting (Weather Underground, 2022).  Weather forecasting uses past data to make short term forecasts.  Based on past history and the radar returns on the clouds in the storm front approaching Stafford, a severe thunderstorm is predicted.  It is fact based, uses experts, and is short-term.  There is little or no uncertainty; the storm will hit soon.  Another example would be forecasting a developer’s expense rate.  If I have a software developer who is building a project using ten people, their monthly expense rate is known and generally static (with some fluctuations for holidays and leave).  I can forecast what the next three month’s expenditures are based on the previous year’s expenditures.  My forecast would be relatively accurate, unless something out of the ordinary occurs.

Scenario planning is a thinking process to plan for potential futures based on risks and uncertainties.  In other words, planning for multiple futures.  Scenario planning has a long-term perspective, has many assumptions, is based on relationships and causality, and considers risks and uncertainties (Mortlock, 2021).  With my employer, we tend to think of two futures; most-likely case and worst case.  From a cybersecurity perspective, one of the worst problems for an organization is the risk of an insider threat (Zimmer et al., 2021).  We cannot forecast with any certainty which organizations will have an insider threat, but we can create a scenario where an insider threat has occurred.  Similarly, we cannot know what computer networks have been compromised by either an insider threat or an Advanced Persistent Threat (APT), but we can create scenarios where those compromises have occurred (NSA, 2014).  And, if the scenario is likely, we can create architectures assuming the threat is inside and present (NSA, 2021).

For forecasting, I think short term and knowable, such as weather or expenses.  For scenario planning, I look at worst case and likely case, with guesses and estimates.  Using my cybersecurity example, my worst case is that I have an insider threat and an APT on my network, working with each other.  My most likely case is that I have an APT on my network.  My mitigation is to use a zero-trust architecture, and to use the recommended strategies for ensuring employees do not become insider threats.  In this way, I am attempting to mitigate my worst case and most likely case scenarios.

 

References

 

Mortlock, L. (2021). Scenario Planning vs. Forecasting: 6 Questions to Ask to Prepare for a Post-Pandemic Future. https://www.leadershipnow.com/leadingblog/2021/05/scenario_planning_vs_forecasti.html

 

NSA. (2014). Operating on a Compromised Network. https://media.defense.gov/2020/Jul/09/2002451274/-1/-1/0/OPERATING%20ON%20A%20COMPROMISED%20NETWORK%20-%20COPY.PDF

 

NSA. (2021). Embracing a Zero Trust Security Model. https://media.defense.gov/2021/Feb/25/2002588479/-1/-1/0/CSI_EMBRACING_ZT_SECURITY_MODEL_UOO115131-21.PDF

 

Weather Underground. (2022). Stafford, VA Severe Weather Alert. https://www.wunderground.com/severe/us/va/stafford/KVAAQUIA2

 

Zimmer, E., Burkert, C., & Federrath, H. (2021). Insiders dissected: New foundations and a systematisation of the research on insiders. Digital Threats: Research and Practice (DTRAP), 3(1), 1-35. https://doi.org/10.1145/3473674