A GLOBAL VIEW OF THE YEAR 2000 CRISIS October 13, 1999 DR. HOWARD A. RUBINgreenspun.com : LUSENET : TimeBomb 2000 (Y2000) : One Thread |
October 13, 1999 Testimony of Dr. Howard A. Rubin Year 2000: A Global View Page 1 of 11A GLOBAL VIEW OF THE YEAR 2000 CRISIS October 13, 1999 DR. HOWARD A. RUBIN Chair, Department of Computer Science, Hunter College of the City University of New York CEO, Rubin Systems Inc. META Group Research Fellow Chair, Y2K Expert Service Corps (YES CORPS) Steering Committee of the International Year 2000 Cooperation Center
Introduction More than ten months after my preparing the initial United Nations briefing document on the global aspects of the Year 2000 crisis and fifteen months after my appearance at the Senate Field Hearing in New York City, it is still virtually impossible to create an accurate worldwide picture of the Year 2000 readiness of nations, businesses, and society. This is quite an incredible statement to make and not very good "news" considering that Year 2000 readiness rating "sources" aboundS. ranging from analyst prognostications to industry group reports to information posted on national web pages.
In my opinion, the truly bad news relating to the Year 2000 global picture actually transcends the technical aspects of the Year 2000 problem:
There are approximately 190 nations in the world and there are tremendous vagaries in Year 2000 information availability, content, and accuracy relating to the status of these nations. There is a general lack of understanding of how technology interacts with and impacts most of the world's populace. The world has never faced a technological problem that is global in nature, has the potential to impact every population center within a 24 hour period (perhaps in some way for days, weeks, months, and years thereafter) and can do so with unprecedented simultaneity and multiplicity. There are no global response or emergency service models in existence to deal with simultaneous events of large geographic dispersion.
The dispersion and propagation mechanisms for Year 2000-like disruptions are unknown while we have spent thousands of years mapping the physical geography of the Earth and spent hundred of years mapping and now modeling its weather/ atmospheric systems, the "cyberlayer" is uncharted. In this, the Network Age, a nation's borders are no longer physical and its dominant interactions are not controlled or bounded by geographyS. we do not know what the new cybergeography looks like.
No one really knows if a collection of small technological disruptions occurring over a short time frame will have more or less impact that a single major disruptionS.. how many "bumps in the road" make the road unusable, unsafe, or result in loss of control and loss of life.
Additionally, it is fairly easy to develop a complacent attitude toward the Year 2000 problem in the US and developed nations because of their large pools of technological resources and funding to apply to the problem. However, it is extremely difficult to assess the impact potential of Year 2000 on any single nation or region when the role of technology in its basic functioning is either misunderstood or not understood at all.
Year 2000 risks in the world's less developed (and even developed nations) are not primarily in the information systems which provide support to the revenue generating and profit producing systems of their key enterprises. The real risks are embedded in the basic lifeline systems of their infrastructure and are also embedded in the systems that run processing plants and transport system. Failures in any of these areas can result in loss of life, degradation of quality of life, and even perhaps environmental hazards or disasters. The sources of these risks are both invisible we don't even know that they are there and "not visible" we know that they are there but cannot find or see them. While the general "feeling" is that risks posed by malfunctioning embedded systems or chips is relatively low, the fact that the probability is low does not imply that these are not risks.
>From a US-centric standpoint it is hard to imagine that such risks exist at all with any degree of probabilistic significance. In the US we live in a Year 2000 information environment with abundant sector reports, hearings, and community activity. However, as I write this statement, the YES Corps team that I am part of is assisting more than 40 nations with serious concerns about their power generation and distribution systems, international telecommunications gateways, healthcare delivery mechanisms, and transport systems. Most recently concerns have arisen in the areas of process plants/ refineries, water supply, defense, and even educational record systems. Yet another concern of many nations that the YES Corp assists, has to do with accuracy of the world's perception of their Year 2000 status. There is real fear of capital flight, loss of the revenue of tourism, and other similar impacts based on improper or misleading information.
A Global View and Commentary With all this said, based on my continual global research and tracking of Year 2000 issues, my role as Chair of the IY2KCC Y2K Expert Service Corps [YESCorps], my direct involvement with Y2K coordinators around the world, and work with major multi-national corporations I would describe the current state of the world as follows:
1) Year 2000 "conventional wisdom" says that all is fine globally with the a view of Year 2000 readiness summarized as:
By geography Developed countries have made the most progress: U. S., U. K., Canada, and Australia
Major progress is being made by infrastructure providers worldwide Progress is not uniform developing nations may be at risk
By sector Financial services is farthest ahead both in the US and around the world Energy, telecommunications, transportation, etc. are falling into place
Unregulated industries, government, and smaller firms are often behind 2) Most commentators, analysts, and gurus consider some level of disruption to be likely, though the nature of the disruptions themselves is rarely pinpointed. The Year 2000 as "a bump in the road" mantra is regularly repeated very little attention is being paid to low probability high impact disruptions.
Of additional concern is the fact that this category of disruptions is being pushed aside and ignored by many who equate level of spending to solve Year 2000 problems with the adequacy and effectiveness of the solution. The "conventional wisdom" applied to this area is that we have spent so much money that the problem has to be solved. If only this rule could be applied to matters of health, education, and poverty.
3) The view of Year 2000 progress that dominates is a "high risk" view and is the greatest source of Year 2000 risk in itself. As I stated in my first Senate testimony, the Year 2000 issue is typified by "known knowns" the things we know we know about the "known unknowns" the thing we know we need to find out about and the "unknown unknowns" those things that we don't even know we don't know.
Worldwide progress in developed nations and most developing nations has focused on resolving the first two categories known knowns and known unknowns and reducing their potential individual impacts to almost nil. The full impact of Year 2000 has always been and is now wrapped up in the domain of unknown unknowns. These unknown unknowns exist primarily in the interfaces between organizations and nations, they exist within the enactment of contingency plans and continuity plans that remain untested, they exist in the activation of contingency and event management practices that are based on conflicting assumptions, and they exist in the very nature of the Year 2000 event and its extensive time impact window.
4) "Second order" risks are now apparent. In dealing with the known knowns and known unknowns, industry and sector groups have continued to pursue assessing the state of regions, nations, provinces/ states, and municipalities along sector lines. Organizations such as the Global 2000, ITU, IATA, and others have pioneered these efforts. However, the totality of areas of concern now appears to be too large to assemble a single picture at any level encompassing electricity, gas, water, telecommunications, oil/ fuels supply, coal supply, nuclear, natural resource production and refining, financial processes, transportation, air traffic control/ aviation, road traffic control, rail, ports and shipping, food, hospitals and healthcare, fire and rescue services, police, military/ defense, media/ broadcasting, public assistance, immigration/ customs/ border control, and more.
More recently, a major shift in the global position and posture with regard to Year 2000 has to do with the realization of the level of interaction between and within nations and sectors. This coupled with an expansion of Year 2000 focus to continuity planning has resulted in the emergence of a set of second order risk areas resulting from: Conflicts in planning assumptions
Conflicts in emergency event management actions Conflicts in contingency communication mechanisms Conflicts in communication advisories Conflicts in public preparedness communiqués Conflicts in information Conflicts of authentication
5) There is an understanding that of the unknown unknowns, public behaviors are perhaps among the highest risk category. While Year 2000 disruptions manifest themselves through increased risk to business and social/ governmental systems in general, the sources of risk are both technical and behavioral. It is the latter category of risk--behavioral --that is rising in concern worldwide and is beginning to be addressed through media and communication planning. However, the schizophrenic nature of media and government communications ---everything is fine but we have printed extra money and have food on hand can itself induce problematic behaviors through the setting of unrealistic expectations.
It appears that the critical area of competency for Year 2000 success is likely to be in the area of continuity planning which involves insulating the populace from disruptions in services, processes, and product while communicating realistic expectations. As such, many nations are now posting public information as to their state of readiness and public precautions. In short, the solution/ resolution of the Year 2000 problem has shifted from purely technological actions to those involving processes and behaviors.
6) From a global readiness perspective, more recently, the International Year 2000 Cooperation Center (August 25, 1999) has provided the following international picture: General Seventy-two of 195 (37%) countries have reported their information publicly.
The Health sector reported the latest completion dates, followed by the Government Services sector. The Finance sector reported the earliest completion dates. Eastern Europe/ Central Asia and South America, with 40% and 70% of countries reporting respectively, reported the latest average completion dates. Sub Saharan Africa reported the least dependence on technology in its critical sectors, followed by Eastern Europe/ Central Asia, Central America/ Caribbean, and the Middle East/ North Africa. North America and Western Europe reported the highest dependency on technology. Contingency Planning Health
Eleven countries (51%) have completed their plans, with nine having plans adopted and approved, and two having tested them. Thirty-seven countries (15%) having contingency planning underway. Fifteen countries have a planning team, and nine have not specified. Government Services
Twelve countries (17%) have completed their plans, with ten having plans adopted and approved and two having tested them Forty-five countries (63%) have contingency planning underway. Six have a planning team, and nine have not specified. Energy
Twenty-eight countries (39%) have completed their plans, with 17 having plans adopted and approved, and 11 having already tested their plan. Thirty-nine countries (54%) have contingency planning underway. Four countries have not specified, and one country has a planning team in place.
7) With multiple sources of readiness data available, the only way to form a composite picture is to look at Year 2000 readiness in the dimensions of "readiness" itself and the degree of consensus by looking across multiple rating bodies. Ray Strecker of American Management Systems has created such a rating analysis map as shown on the page that follows. Multiple rating sources were reviewed for a selection of countries for which data was available.
A Year 2000 Agenda for the United States In my opinion, much work lies ahead in addressing the Year 2000 problem from a true global vantage point. While technical progress in remediation of systems must continue at the most rapid pace possible, basic key focus areas over the next months must include:
Developing multi-sector/ multi-nation continuity and community plans Identifying and management of dependencies along with underlying planning assumptions Assessing and reacting to events and risks on an ongoing basis Mobilization and involvement of NGO's and emergency services organizations Communicating and maintaining/ managing public awareness Understanding risks posed to security and the potential for cyberterrorism
Beyond these basic focus areas attention must be paid to the post-rollover period. Whether it is just the high probability small disruptions or some of the low probability high-impact events that occur, immediate attention must be given to the creation of what have been called "reconstitution teams". These are groups of experts that can assist nations with a rapid return to normalcy if a failure of any type occurs. In addition, I can also see an immediate need for what might be deemed as "preconstitution teams" ---teams of experts than can be deployed now for tactical infrastructure assistance to nations that believe they are in need of such assistance.
I do not see these actions as the sole burden of the US. I do believe that it is the role of the US government to develop ways it can assist in this new form or foreign aid or what perhaps is the genesis of a new form of global aid. The US government must also take on the responsibility of ensuring that the people of our nation have the best possible information available to them about the true state of the nation and the world. It is imperative that all Federal, State, and Local government agencies provide timely and accurate information to their constituents and continue to update such information. Furthermore it is imperative that the US cooperate in the mapping of critical dependencies between nations. Finally it is imperative that realistic expectations be set as to a range of possibilities and that the US government not fall into the trap of the complacency of arrogance.
No city or nation can ignore any of the risks imposed by the Year 2000 problem. The US shares the potential of risk and is also in a critical position because of the dependencies that result from its pivotal position in the regional, national, and global marketplace/" socialplace". The US must carefully evaluate its own risks, the risks it imposes on others, and understand who or what generates risks to the nation itself. Nothing can be assumed, nothing should be kept from the public, and no external dependency can be uncharted and have no "owner".
>From its internal governmental systems that provide support to social, health, education, safety, transport, and financial programs for those that can least afford a Year 2000 impact, to its systems that support those that support the regional, national, and global economy, the US government has no choice but to be prepared and have a prepared populace and public officials. In addition, the US government must be prepared to supply and maintain information for its partners and people throughout the transition and be prepared to do so for many months and perhaps years to come.
The impact of the Year 2000 problem whether it results in technical failures of any serious magnitude or not will be determined by public behaviors. Communication, broad based coverage and analysis of all potential risk areas, and plans to provide pre-event readiness, date rollover management (the "Zero-Day"), and post-event event management are the critical areas.
I urge you to stay in touch with what is going on in all critical agencies, sectors, regional organizations, national organizations, and international groups. I further urge you to insist that the nation be provided with a continuous stream of honest information as to status, impacts, plans, and possible scenarios that they need to be prepared for. I finally urge you to support the global community by enacting and funding mechanism by which lessons learned can be disseminating around the world rapidly to assist any nation in need.
Concluding Comments The media and even analysts have pointed out similarities between the Year 2000 problem and recent events such as Hurricane Floyd. However, don't get fooled into thinking that these events are really similarS they are not. Quite simply, when facing a hurricane we can board up and protect our homes with plywood. We are now faced with the potential, however low, for a global hurricane/ cyberstorm for which we have been given a very long range forecast. But the problem is, that because of the very nature of this potential event, we do not know what the "plywood" is.
I am truly hoping that the Year 2000 crisis will be a "non-event"S. Not because it is not real or was never real as some say, but because preparedness and communication have placed us in a position of readiness such that all risks imposed have been abated or mitigated as they arise. 8 October 13, 1999 Testimony of Dr. Howard A. Rubin Year 2000: A Global View Page 9 of 11
"100 Days Away" Year 2000 survey results Dr. Howard A. Rubin Box 387 450 Long Ridge Road Pound Ridge NY 10576 (914) 764-4931 (914)-764-0536 (fax) howard_ rubin@ compuserve. com
September 13, 1999
________________________________________________________________ The 100 Days Away/ 3Q1999 Rubin Systems/ Cap Gemini America sponsored Year 2000 survey results have been compiled. The demographics of the survey cover a profile of responses of 156 Fortune 500 organizations on Year 2000 issues and post Year 2000 directions. At a high level, the key results of this survey indicate:
Year 2000 projects are proceeding well with a big push in the area of continuity planning. Although many companies will not have 100% their systems converted they do not seem to believe that this poses a major business risk. Business "complacency" seems to be setting in. Meanwhile costs have increased due to unexpected contingency planing, command center, and IV& V costs. An interesting issue has to do with the fact that most companies have not decided how they will redeploy their "heads down" Year 2000 staff. Managers and project leaders seem to be protected however.
Key Findings: There has been some budget "creep" upward in total Year 2000 spending. The primary drivers of this budget movement are: Budget Area Pct Indicating as Cost Driver Contingency Planning Costs 26 Need for IV& V 24 Command Centers 20 Program Management Costs 10 Hardware upgrades 8 Conversion Costs 6 Personnel Costs 6
48% of those surveyed now claim that it is very likely that they will not do business with non-Y2K compliant suppliers/ providers (up from 36% in July). However about one-third of the companies do not consider this to be a major business issue. 98% of those surveyed believe it is not likely that they will sell off or reorganize part of their businesses because of Y2K concerns.
80% expect to use Y2K compliance as part of their marketing message.. this is down from 88% in July. Business partner and vendor compliance cooperation still remain as big issues with the level of cooperation continuing to decrease. 87% of companies expect to provide Y2K information to their customers. Continuity planning is becoming more of a joint business/ IT effort (90% of those surveyed).. the number of IT organizations doing it alone has dropped to 4%. 98% have determined that their existing continuity plans support less than 25% of their Y2K needs.
68% of contingency plans now involve a possible service shutdown or a degradation of service in response to a Y2K problem after the date rollover.
The need to increase staff to support continuity planning has been indicated by 85% of those surveyed. The staff assigned to such work is rating it as more "exciting" than previous Y2K systems-related work. Post Y2K commitments to staff are an issue: 82% have plans to redeploy their program managers
66% have plans to redeploy their project leaders only 26% have plans to redeploy their conversion and assessment personnel While 12% of those surveyed indicate plan slippage is increasing and 10% indicate a decrease, 78% claim that slippage has stabilized 56% of those surveyed now expect 100% of their systems to be compliant by year end (up from 48% in July). 38% of those surveyed expect that 76% to 99% of their systems will be compliantS that leaves 6% of those surveyed with less than 75% of their systems planned to be compliant by year end. However, overall 82% of those surveyed do not expect the non-compliant systems to pose a significant business risk.
82% of those surveyed have had a Y2K related failure. 56% of those failures were caused by systems that have not been replaced yet; 44% were caused by systems that have been
remediated. The dominant failure type is a miscalculation. 99% of those surveyed expect such problems to continue to increase to year end.
Key post-rollover Y2K related priorities include event management, conversion of secondary systems, catching up with backlogged work, and redeploying staff. 98% expect to build a new strategic IT plan, 60% expect to reorganize IT and 60% expect to start focusing more on e-strategy.
It appears that Y2K has inhibited progress in key IT initiative areas: 82% indicate it has inhibited ERP projects 78% indicate that have delayed outsourcing decisions 25% indicate that they have delayed CRM projects 22% indicate they have delayed SFA projects 18% and 15% respectively indicate that Y2K has delayed e-business BtoB and BtoC projects respectively
-- Brian (imager@home.com), October 14, 1999
my eyes are worn out from reading that!!!
-- Jay Urban (jurban@berenyi.com), October 14, 1999.
This is the Statement that sticks out in my mind and something that this forum has tried to deal with and some think is the major issue that will humble the critics of y2k awareness."The dispersion and propagation mechanisms for Year 2000-like disruptions are unknown while we have spent thousands of years mapping the physical geography of the Earth and spent hundred of years mapping and now modeling its weather/ atmospheric systems, the "cyberlayer" is uncharted. In this, the Network Age, a nation's borders are no longer physical and its dominant interactions are not controlled or bounded by geography. we do not know what the new cybergeography looks like."
-- Brian (imager@home.com), October 14, 1999.
JaySorry about the all caps but I copied and pasted the title :o)
-- Brian (imager@home.com), October 14, 1999.
"But the problem is, that because of the very nature of this potential event, we do not know what the "plywood" is."Speak for yourself, Rubin.
We Yourdonites do.
-- lisa (lisa@work.now), October 14, 1999.
OOooooooooooooooo, very Doomer.Gotta study this one.
-- Ashton & Leska in Cascadia (allaha@earthlink.net), October 14, 1999.
anyone up for a class action suit against all "they" who said "this cannot happen"?82% of those surveyed have had a Y2K related failure. 56% of those failures were caused by systems that have not been replaced yet; 44% were caused by systems that have been remediated. The dominant failure type is a miscalculation. 99% of those surveyed expect such problems to continue to increase to year end.
"increase to year end?" to year end? gee...I wonder what will happen at the rollover? Magic? Isn't that when the REAL FUN is suppose to start?
argh...
"this is gonna be bad...hold on to something...HOLD ON TO SOMETHING!!!"
Mike
=============================================================
-- Michael Taylor (mtdesign3@aol.com), October 14, 1999.
56% of those surveyed now expect 100% of their systems to be compliant by year end (up from 48% in July). 38% of those surveyed expect that 76% to 99% of their systems will be compliantS that leaves 6% of those surveyed with less than 75% of their systems planned to be compliant by year end. However, overall 82% of those surveyed do not expect the non-compliant systems to pose a significant business risk.Anybody else notice some, ummm, missing words here?
-- Hoffmeister (hoff_meister@my-deja.com), October 14, 1999.
-- Ashton & Leska in Cascadia (allaha@earthlink.net), October 14, 1999.
Hoff and everyoneThis is a conversion from the PDF file and often the formatting leaves it a bit confusing so be advised to check the original for clearification
Howard Rubin
-- Brian (imager@home.com), October 14, 1999.
BrianI wasn't implying you cut out any words. The words aren't there in the PDF either.
-- Hoffmeister (hoff_meister@my-deja.com), October 14, 1999.
Sir Hoffmeister:>Anybody else notice some, ummm, missing words here?<
Could it be "Mission Critical" that is missing? This seems to imply that ALL systems were involved in the report. True?
S.O.B.
-- sweetolebob (buffgun@hotmail.com), October 14, 1999.
The Senate's Y2K Committee website (http://www.senate. gov/~y2k/hearings/991013/)has been replacing the links to PDF files with links to HTML files.h ttp://www.senate.gov/~y2k/hearings/991013/st991013rubin.htm
-- Lane Core Jr. (elcore@sgi.net), October 14, 1999.
I find this very important testimony. I was hoping he'd have mellowed out a little and give us some encouraging news about international readiness. Seems like the anglos will have it sorted best but there could still be some bad shit everywhere. Was hoping for some more encouraging news about my neck of the woods (Europe, nudge close to the East). Oh well, 'nother can of beans tomorrow.(Sidebar: I wonder if this great disparity in awareness around the world has something to do with the internet being dominated by the English-speaking world? I'd wager that 99 percent of the total information and discussion and knowledge and wisdom on Y2K is in English. About 70 per cent of this total is on the internet - where English is the de-facto lingua franca. Language and access to the internet must have played some role in the spread of awareness, and thus readiness.)
-- Chris Byrne (cbyrne98@hotmail.com), October 14, 1999.
LaneWell thats a good thing to see, how are folks going to be able to "stockpile information" if it isn't in a common format like html. They should have the html and pdf so the documents are both web friendly and printer friendly.
Chris
The fact that the web is mostly english would make a differance. It makes one wonder though if there is an equivilant to Gary North and Paul Milne in another language :o)
-- Brian (imager@home.com), October 14, 1999.
This Rubin dude briefed both The President and Vice President in the Autumn of '95, several months before Monica snapped her Thong underwear during the December '95 Government shutdown.
As I recall, Rubin said Clinton "GOT IT" immediately, but the denser Gore was "educable." So they both knew, and ALLOWED whatever will happen to happen.
But I shouldn't be too hard on Clinton, after all, can you imagine that Dubya would have done anything different??
-- K. Stevens (kstevens@ It's ALL going away in January.com), October 15, 1999.
Hoffmeister commented on a particular passage, re "missing words." Whether or not those missing words were "mission-critical systems" or versions thereof, what I notice is the presence of the word "expect." Expectations are by no means guarantees, and certainty is not in them.As ever, when reading these presentations to the Senate Committee on Y2K, one wonders where the reporters are.
-- Tom Carey (tomcarey@mindspring.com), October 15, 1999.
this one is disturbing, no, shocking, no, alarming, no, cardiac stopping
-- did you read (that@rubin.testimony?), October 18, 1999.
To the top. This is heavy, man.
-- shook up (TB2K@TB2K.TB2K), October 19, 1999.
Post Y2K commitments to staff are an issue:82% have plans to redeploy their program managers
66% have plans to redeploy their project leaders
only 26% have plans to redeploy their conversion and assessment personnel
OK, what does that mean? I can understand why the program and project managers would get redeployed (projects over, have a party, get some sleep, next assignment), but why wouldn't they have plans to redeploy the conversion and assessment teams? Keep 'em in place, just in case?
Or (less charitably), do they perhaps not classify "layoff" as redeployment, so that doesn't count? "They weren't redeployed - they were rightsized".
-- Mac (sneak@lurk.hid), October 19, 1999.
No programmers out of work jan/feb/march/april/may if between 1-6.
-- methinks (no@layoffs.sane), October 21, 1999.
Reallocated to wherever the .gov .mil determines the need is most crucial. Drafted to death march in exchange for food, shelter, and "personal protection" (don't mind that soldier on your left).
-- you code you load (cattlecars@off.criticality), October 21, 1999.
So how many geeks will realize this and join the exodus?
-- embedded programmers (hiding@the.hills), October 21, 1999.