Customs accelerates disaster planning

The U.S. Customs Service is close to awarding a contract to set up two backup facilities where it can access its computer systems and databases in the wake of a disaster or terrorist attack.

The disaster recovery and data replication plan was on the drawing boards before the Sept. 11 attacks, but now Customs officials are working to get the project under way as soon as possible.

The Commercial Recovery Services program includes building a primary backup facility at least 20 miles from Customs' Springfield, Va., data center and a second facility at least 350 miles away.

In a contracting notice, Customs officials said they are seeking firms to replicate the agency's computer systems and regularly back up their data. In the event of a disaster, Customs wants to have the fallback systems up and running with data that is no more than 36 hours old for its mission-critical applications, including its Automated Commercial System, which handles imports at the nation's borders.

The cost of the project is estimated at more than $1 million, according to Federal Sources Inc.

A Customs spokeswoman declined to comment on the project, saying it was "procurement- sensitive." Another Customs official said details of the contract award may not be disclosed because of security concerns.

A Customs office at the World Trade Center was destroyed Sept. 11 when the Twin Towers collapsed, but no Customs employees were injured. Officials were able to relocate the office but lost time in rerouting the work. It is still not clear how much data or paper forms were lost.

Nevertheless, the attacks have raised troubling concerns for Customs, the agency on the front lines of protecting U.S. borders. Although the borders were never closed in the aftermath of Sept. 11, security was significantly tightened. And the Springfield, Va., facility, the hub of the Customs computer operation, sits only a few miles from the Pentagon, also attacked on Sept. 11.

"There have been a number of organizations that have obviously and unfortunately been put on notice that the risks they are facing need to be addressed," said David Krohmal, manager of the General Services Administration's disaster recovery services.

But he added that many agencies have had disaster recovery plans for at least eight years. And at least 50 federal agencies have been using a GSA task order contract awarded to IBM Global Services, SunGard and Comdisco Inc. for recovery help. But now agencies are ratcheting up their plans as they evaluate how they functioned on Sept. 11, he said.

Ron Miller, chief information officer at the Federal Emergency Management Agency, said many agencies did not have operational plans because they did not have the money to spend on extensive business continuity strategies.

"Given some of the issues encountered on Sept. 11 and the days beyond, it has become more important," Miller said.

Now agencies must decide how much redundancy they want in a backup system and whether they need a "hot backup" — a site always running and available in the event of a catastrophe, he said.

"It is essential to have a disaster recovery and business continuity plan in place," said Bruce Brody, cybersecurity chief at the Department of Veterans Affairs. "Whether or not that involves a disaster recovery and replication center, or multiple centers, is based on the needs and special circumstances of each department or agency."

As federal agencies evaluate their disaster recovery needs, many high-tech companies are looking at constructing recovery systems within the walls of the primary operation, according to David Tapper, a senior analyst at IDC.

"The awareness of recovery has been there, but not necessarily as a recovery system. Now we're building recovery within a service, something that sails from primary server to secondary server," Tapper said.

***

Planning for trouble

Under the Commercial Recovery Services program, the Customs Service requires:

* Two facilities to house backup and recovery systems, one located at least 20 miles from Customs' Springfield, Va., data center, the other at least 350 miles away.

* Immediate access to backup data that is no more than 36 hours old.

* Use of centers for up to 12 weeks following a disaster declaration.

* Option of extended recovery services, supporting Customs computing and telecommunications operations for up to 18 months.