A kind of perfect storm of opportunity struck the Canadian security and disaster recovery industry last week:

* Public Safety Minister Anne McLellan announced that the federal government will beef up its spending on security to the tune of $690 million over the next five years.

* A Canadian Security Intelligence Service report on terrorism raised fears of cyber attacks on Canada’s utilities, transportation and communication systems. While it stopped short of suggesting that last summer’s widespread blackout was the work of terrorists, it raised the spectre of “cascading failures” that could make sitting in the dark seem tame.

* Cisco Systems Inc. released a patch for a critical flaw in the TCP protocol that, experts say, “could take down the Internet.” Meanwhile, Microsoft released its usual packet of “critical” security Band-Aids for its products.

File photo by Larry MacDougal, Business Edge
CEO Osama Arafat has Q9 Networks working at solutions.

What’s a computer user to do? Unless we’re willing to go back to quill pens, manual typewriters and rotary dial phones, we are all exposed to some degree of risk when we put our trust in computers and other technologies. McLellan can draw on the public purse to attempt to keep the lights on and the planes flying. But who’s looking out for your home and office technologies?

Luckily, there is a flock of companies ready to help. From the techies at Staples who will de-virus your computer for 50 bucks to high-end national firms, disaster recovery (DR) and business continuity planning (BCP) have become big business. “We have clients here who, if they were down for one or two hours, they’d lose millions of dollars,” says Zak Karbalai, director of security and business continuity for Care Factor Computer Services Inc., which has offices in Calgary,Winnipeg, Edmonton and Vancouver.

Karbalai speaks from the company’s large, unlabelled facility which is located outside the Calgary downtown core. “That’s a key feature we can offer,” says Karbalai, “because if something bad happens downtown, our customers will still be up and running.”

Care Factor president Ecky Pilz reports that while the G8 summit was being held near Calgary, they set up 140 workstations so that their customers could work uninterrupted, even if access to the city core was cut off. “As it turns out,” he says, “it wasn’t needed, but a number of our clients used the opportunity to test their DR plans.” Karbalai echoes that sentiment, saying “if you haven’t tested your DR plan, you don’t have a plan.”

Another player that’s thriving on our fear of the unknown is Toronto-based Q9 Networks (Q-TSX), which just completed a $32-million initial public offering (in addition to $115 million of private equity funding the firm raised in 2000 and 2001). Company CEO Osama Arafat says his company has moved beyond what he calls the “insurance model” of disaster recovery, which is “a collection of equipment that is essentially oversold, hoping that not everyone has a disaster at the same time.”

Instead, Q9 provides managed hosting services and outsourced Internet infrastructure from data centres in Toronto and Calgary.

Arafat notes that during the August 2003 blackout, the computer screens of Q9’s customers didn’t even flicker. “We have our own diesel generators and HVAC equipment, so we can essentially keep them running forever,” he says.

And while he acknowledges that the firm’s Calgary facility is not outside the downtown core, he says that companies can still avoid putting all their eggs in one basket. “We have Toronto companies that use our Calgary data centre for some of their processing. They do this for load balancing as well as protection.”

He notes that as companies become more dependent on e-commerce and other interactive services, there’s a movement to what he calls “hot/hot” infrastructure. So instead of packing employees, manuals and data media off to an emergency site, the “backup machine” is always running regular production work. If some of the capacity goes down, users might see a degradation of service, but not a complete outage.

The other big player in DR/BCP in Western Canada is Telus Corp. (T-TSX).

Like the shoe salesman confronting barefoot people in Africa, Telus director of business continuity Ivan Kusal sees huge opportunity. “We saw from 9/11 that 80 per cent of those companies didn’t have a business continuity plan,” he says, “and the technologies used by many companies today are pretty complex.”

Yet Kusal also sees great opportunities for technology to assist in time of disaster. “We were able to rapidly install emergency phone lines for disaster workers during the B.C. fires,” he says, “as well as to meet the needs of federal and municipal governments.”

He notes that sudden crises such as SARS might cause any company to need a Plan B for its voice and data communications.

“Using Voice over Internet, we can get them back on the air without a lot of time- consuming re-cabling,” agrees Telus planning manager John Yamniuk.

According to these experts, planning to keep the business alive in the face of a disaster has now moved up the food chain. It used to be something the IT manager worried about in his or her spare time. Now, it’s a board-level responsibility. “They need to make sure that they protect all shareholders,” says Q9’s Arafat. “For many companies now, the livelihood of the business depends on its computing infrastructure.”

As we enter another summer that may bring fires and blackouts, not to mention the ever-present threat of physical and cyber terrorism, business leaders who choose to ignore DR/BCP just might find themselves on vacation at the lake . . . forever.

(Tom Keenan is a professor at the University of Calgary and an expert on technology and its social implications. He can be reached at keenan@businessedge.ca)