The risk of a major flood in the the Ile-de-France region is also a challenge in terms of Information Systems Security [by Vincent Balouet, maitrisedesrisques.com]

The risk of a flood in the Ile-de-France region really is the one risk that dominates all others. All the professionals who tackle the subject are literally stunned by the potential consequences of such an event.

Let’s summarise. Paris lies on a plain. Upstream is a 200km-wide area of gently sloping funnel-shaped terrain. The Seine flows through the city in a channel one hundred metres wide, sometimes less. In the Val-de-Marne area that could become a lake lies critical infrastructure (waterworks, etc.). In the Hauts-de-Seine, the Seine meanders through an economic area of unparalleled importance. The scenario is slow, very slow. In the event of a flood, the Seine’s flow will increase tenfold.

Talking schematically, we can identify four areas (the exact outlines of which are unpredictable). The first would be submerged by water, with everything cut off and inaccessible. The second, much larger area would be dry to walk on but would lose its utility networks (energy, telecommunications, heating, etc.). In the third area, further away, the networks would be able to operate but there would be knock-on effects, blocked transport and general disorder. In the fourth, even further afield, everything would look normal except… the things we depend upon – our customers and suppliers, logistics, staff, family….

A flood is likely to happen during the coldest period of the year, or in the spring. Rising water levels (around 50 to 80cm per day, maybe more) are flooding docks and bankside roads. Forecasts (2 days, no more) are on the increase. The media will do their job as the water rises.

No one can predict the maximum water height we will experience. What’s worse, no one can predict how we will handle all this. To shed more light on the phenomenon, let’s establish two scenarios. In the first, ‘best-case’ scenario, faced with higher water levels (compared with events in recent months), we behave perfectly, in an ideal manner… In the second, ‘worst-case’ scenario, faced with the same hypothetical flood, we enter into a general scramble, at all levels…

Best-case scenario: The water rises… The public authority crisis units, impeccably coordinated and transparent, placed outside the sensitive areas, inform local people and businesses, giving them a simplified and realistic reading of the situation, forecasts and practical consequences. The maps are up to date, and smartphone applications, developed by Vital Infrastructure Operators, work. Thus, feeling that there is a pilot on the plane, the various layers of society calmly make their arrangements. The construction of protective structures and barriers (at 400+ strategic points: underground stations, car parks, etc..) is seen as a sign of confidence in the management of the operations. The individual families affected calmly send their children to stay with family members in the region. They are enrolled in local schools thanks to the national education system’s Plan B. As planned and announced, electricity is suddenly cut over a large area along the course of the Marne and Seine rivers. In the meantime, the local authorities have managed the schools, hospitals, nurseries, infrastructure, etc. Companies, who have realised that the crisis will last for several months at least, have moved their critical activities outside the area. Information technology has been adapted, staff are able to work remotely, everyone has succeeded in organising themselves calmly so that they can live comfortably and work effectively for around 2 months. The water, which continues to rise, leads to the closure of stations and bridges. From Le Havre to Troyes, France is cut in two, with impassable rivers, but the logistical impacts have been anticipated thanks to effective dual communication (individuals and businesses). The coordinated response of foreign rescue and support teams allows the impacts to be limited. …. Companies have planned for everything and initiate and implement their Plan B without leaving anything to chance. As for IT, CIOs have succeeded in reconfiguring their systems (teleworking, help desk, maintaining ISS at its nominal level) without problems, while protecting their own infrastructures. When the water goes back down, around ten days later, we discover that the protections have held despite the pressure of the water: no leaks, no oversights, no malevolence – the infrastructures have been spared. No problem maintaining law and order either – no looting, no pollution, no health impact…. The barriers are taken down; the technical checks are conducted swiftly… no damage, no collapse or subsidence. The house of Grand Paris is reconnected without a glitch; services resume (water, urban heating, waste collection, etc.), inviting people and businesses to resume their activities as before the flood. The building safety inspections are carried out in record time. Business as usual: the tourist season is maintained, the private and corporate real estate market is intact, we are ready for a second flood, confidence is high, the stock market goes up…

Worst-case scenario: the rising water is not anticipated well enough, poorly announced and poorly communicated. Caught unprepared, local people and businesses become stressed or even panic at the sight of the spectacular protective structures being put up. Individuals attempt to leave the area when the stations and some roads are already closed. General chaos sets in. Companies try to return to their sites in order to get together everything required to work remotely for a long time. Utility networks (energy, telecommunications, etc.) fail almost without warning. Wherever the energy is still working, there is a lack of staff, trucks are blocked… Cottoning on to the fact that this will last for months, companies begin to extract materials and equipment, and there is a mass exodus from the area as the partial destruction of infrastructure is announced: the protective barriers did not resist the onslaught, Parisian basements are flooded. The pumping will take months; no rehabilitation timeframe is announced.

Employees are sent away from the centre of town for ‘some time’. With children in the provinces, families are torn apart for months. Disputes take hold, including in companies. The BCP teams attempt to salvage anything essential; IT muddles through somehow. Part of the IS is suspended; fail-soft operation has to be activated, sometimes giving up on security. Many key members of staff are absent and unreachable. It is announced that it will take several years to repair stations, tunnels, the underground system and various infrastructure. Some roadways have collapsed, hundreds of buildings have cracked or caved in, certain weakened bridges will remain closed.

The tourist season is lost; the companies that have survived establish themselves far away from the affected areas. IT departments, head offices, industrial infrastructure – anything that cannot be moved in two days has definitively left the area. An unprecedented crash hits the real estate market. The value of apartments, houses and office blocks in the area is in free fall while the credits roll. The insurance sector is put to the test, the technical provisions are impacted and, despite the reinsurance and solidarity mechanisms, a financial shock occurs. With the departure of thousands of workers and children, a kind of disorganisation spreads through the area. The metropolises around Paris are overloaded: Lille, Le Mans, etc. see their business activities increase significantly. Confidence will take years to return, as we await the next flood. The business community and investors are perplexed…

We will have neither of these two scenarios. Specialists in this matter broadly concur that the difference between those two scenarios is fully dependent upon the performance of all public and private stakeholders. What will happen is fundamentally up to us, unless we consider ourselves unconcerned by the risk of a major flood in Paris.

There is therefore a real risk of the Paris economic plate being destabilised if we are victims of a double phenomenon: a major flood and its mismanagement. This risk concerns a very large area. The direct impacts will stretch from the city centre to the outskirts of the Parisian region. The indirect impacts will go far beyond this for all companies that work with this zone or have logistics operations going through the area. Companies that believe they will not be affected because are located outside of the flood zone are mistaken: this concerns all businesses, including in neighbouring countries.

It is, therefore, essential for us to understand that the risk of a major flood in Paris really is something that could escape our control if we are not careful. ‘We’ refers to the various stakeholders in the operation: from the government level at the top to trade associations revolving around ‘continuity’ subjects, local authorities, consular chambers, the Medef, CGPME, UPA, trade unions, Vital Infrastructure Operators, large, medium and small companies, experts, employees, citizens, journalists, etc. All of us.

While the real consequences of mismanaging a major crisis are 90% related to the functioning of the zone’s economy, the information allowing companies to prepare themselves still remains massively unavailable or poorly targeted. A quick look at our British and American friends reveals the extent of the difference: websites (up to date), available maps, little or no jargon, regulations acting as an incentive (i.e. binding) – everything is done to inform, engage and empower the economic fabric. An effective, all-smartphone strategy allows every executive to know the risks, situate themselves, have check lists and send alerts… via simple applications provided free of charge (State, network operators, etc.).
Here in France, we have to be diligent investigators to lay our hands upon an up-to-date map and means of prevention and alert. What’s more, we have to conduct guesswork based on the maps alone, with red meaning flood alert for ‘Vigicrue’ whereas we have to look for blue (not red) on the BRGM map… There is no clear website for businesses; no one really knows whether we will be effectively informed of network cuts in the area, or indeed the restarting of these same networks.

Deprived of this essential information, ‘business continuity’ managers in companies are required to guess everything and put in place an effective backup strategy within two to three days. An impossible task.

We can therefore, without compromising ourselves, venture to make some recommendations in the form of a wish list: provision of all plans, maps and basic information, presented in French (and not administrative jargon), intelligible for company leaders, with declassification of all necessary elements; simple and effective smartphone applications, designed to maintain the economy; dual communications organised and coordinated for the attention of both local people and companies (whose priorities are totally different); estimates of cuts and re-commissioning of networks and infrastructures, the publication of which would be made compulsory, unless one considers vital infrastructure to be anything other than vital…

The cost of these common-sense measures would be trivial. The day a flood occurs, companies will not need assistance, but rather information. The level of what is at stake amounts to around 80 billion Euros.