Threat modeling for disasters

Environmental hazards

Investigate what sorts of hazards are likely to occur in your region by using available tools. If you can’t trust the tools, talk to people who have been around for a long time about what is likely to happen and how to prepare. Discuss it with neighbors. 

  • First, find broad strokes. I’m in the Bay Area, so I look up earthquake hazards at a large level to see where one might occur near me.
  • Narrow down to your region. I look up liquefaction zones because that’s what matters in an earthquake.
  • We also have wild fires in California, so I find the state’s hazard website, which tells me which areas are protected how against fires and other hazards.
  • Floods can happen just about anywhere. Here’s the current way to look up your flooding risk.

There are often environmental justice organizations in each region as well, who will have different maps that include super fund sites you’ll need to be wary of if you can no longer trust that government one. During 2017 we worked with Public Lab to find and combine maps of issues.

Political hazards

Depending on the political climate where you’re at, you may face some challenges to your response organizing work.

  • Disinformation – people may try to skew information people are getting in order to further their own political ends. Be aware of who you can trust, and read the pages in here about understanding and combatting disinformation.
  • Cops – bullies with power may tell you that you can’t do some of the things you’re doing. Know your rights in your area, and record interactions. And shut the fuck up. Have your local legal team’s number written down and/or ideally memorized.
  • Wanna be cops – bullies with guns and a sense of power may come by and try to interrupt what you’re doing. Have a sense of what risks you’re willing to take, and stand your ground whenever possible. Have a crew of folks who are willing to show up against these folks, and have them be on an on call rotation. 

Community hazards

Hopefully you already have a sense of who is in your neighborhood. If you don’t, start knocking on doors with cookies. 

  • Narcissists – who is going to show up and look for power in order to look good? They’ll drive things in a way that doesn’t help the community but has their name all over it and looks good for a moment in the news. Not willing to share power or take critical feedback. Should be removed from power and ignored as early as possible. Grey rock that shit. 
  • Spontaneous unaffiliated volunteers – people who show up and disrupt your work in order to “help.” Figuring out who is useful and who is going to get in the way is vital. More in that article

Community resources

Map your neighborhood for resources folks are willing to provide. I did this by showing up to community events with a form for folks to fill out with what they were willing to provide, posting on community forums, and hosting disaster-themed get togethers for folks who were interested.

  • Power – who has generators or solar with batteries
  • Water – who has water stored in their house, and is likely to fill up a bathtub
  • Food – who keeps a backstop of food at their house and is willing to share
  • Medical capabilities – who can help with medical issues
  • AED – anyone who keeps an AED in their location
  • Disaster experience – those who are trained and/or experienced in disaster response
  • Block captains – folks who are willing to check in on each other in a crisis

Kickstarting like it’s 2009

So all those blog posts I’ve been making about informal disaster response? Yeah, it’s growing into a full-on zine. Drew and I have enough put together that we can publish something in the first quarter of the new year, but we’d like to make it even bigger and better. So we’re doing a kickstarter like it’s 2009 again or something.

I’m hoping to pay some folks what they’re worth to do a full-on website, some extra graphics for the zine, and finish up some great articles. It can end up shipping as the mostly-Willow-show, but that doesn’t feel good or right. I’ve run through my 5k personal budget of what to spend on generating this, but people keep getting excited for what it could be. So this Kickstarter is to see if there’s enough heat there to expand the scope. Throw in and share if you think it’s a nice idea. Otherwise, no worries. We can still ship with what we’ve got.

Documentation in disaster response

There’s so much going on! Surely slowing down to write about it isn’t worth the time and effort. But it is! Promise.

Use it for learning, use it for community

  • Lightening your onboarding lift – if you write down how something works, it means someone can onboard themselves while you focus on more complex things. Bonus if each person updates the documentation to help the next person do even better based on what they learn.
  • Passing on knowledge – we shouldn’t have to keep reinventing the wheel for crisis response. What did you learn, and can you teach it forward? Occupy Sandy folks helped those organizing about the tornadoes the following year.
  • Solidifying what you know – do you really understand something until you’ve written it down and someone else has done a review of it?
  • Helps with fundraising and countering misinformation. You’ll have a written log of what happened, when, that can be used as reference in the future.

Celebrate your documentarians! It’s fairly thankless work that helps the whole organization keep going smoothly.

Continue reading

Flying drones in disaster zones

This post is from Rakesh and Pascal of Crisis Commons, who know WAY more about drones than I ever will. I tweaked a bit for flow and readability. They’ll be hosting a conversation soon amongst folks who are sharing airspace to figure out how to be good neighbors to each other – hit us up if you’d like to be a part of that at connect@crisiscommons.org and my first name at this blog’s domain. That conversation will apply to Milton as well as Helene. 

On Thursday, the FAA reported 30 “near misses” of crewed flights in the Helene disaster area in one 24 hour period. 

TL;DR for operating aircraft <400ft

  • Uncoordinated shared airspace, and its near misses, bring crewed aircraft delivering aid or performing rescues to the ground for the safety of the crew. Crewed aircraft ALWAYS takes precedence over drones both for human safety and for response needs.
  • Drone pilots are always legally responsible for understanding any relevant restrictions and airspace authorizations necessary.
  • Local authority doesn’t have ownership of the skies. A police officer cannot (usually) tell you not to fly. The FAA coordinates the sky, and you should follow their guidance as best you can for the safety of all.
  • Here’s how the FAA would like you to be operating in disaster zones. (H/T to jdg for finding this link)

It is not your god given right as an American to crash into a helicopter.

Continue reading

Dealing with Money in disaster response

Co-written with Devin Balkind. Much love to Drew Hornbein, Seamus Brugh, and Mark Ferlatte for their input on this piece. 

At some point, if you are visible enough, people will want to give your group money to do what you’re doing in responding to the crisis. 

Ideally, you will have been tracking who is putting money into the response so you can later pay them back if outside donations start coming in. Have a spreadsheet somewhere that folks can see (but not necessarily edit – see “data security”).

Some quick models that might work for you

If you want to be able to take tax deductible donations quickly, you can partner with a 501c3 in something called fiscal sponsorship where they take the donation and then pass it through to you after taking a small amount as administrative overhead (I’ve seen 10% most often). Some bureaucracy and you have to partner with an org that is values-aligned. You’ll want to take a look at a Memorandum of Understanding (MOU) to see how these partnerships are set up.

If you want to move fast and are expecting small amounts of donations, and don’t care about tax deductible donations, you can just open up a business bank account as a sole proprietor. There will be confusing tax implications later, someone in your group who has been an independent contractor will have insights. If you want more folks on the account it can get more complicated by needing to form a business or nonprofit (see below for when you have more time), but a local bank or credit union will want to help you figure it out. 

Framing conversations about dealing with money

Money often starts coming in AFTER you’ve already figured out what you’re doing and why. But people will start to see what you’re doing after you’ve been doing it, and want to support you in doing so. This means some of the tenor of your work will already be shifting as funds start coming in. You’ll be shifting from the response phase (getting people off of roofs and from under rubble) and into the recovery phase (getting people food and medicine, gutting houses, setting up warming shelters; longer term rebuilding housing, reestablishing businesses).

Continue reading

Self and Community Care in Crisis

With love to Kate Falkenhart for her additional kind contributions and course corrections to this post.

We’ve all heard about self care at this point, and probably even have our own routines. However, when crisis strikes, it can be tempting to throw out your adaptive routines in favor of all the pressing work that surrounds you. When this is the case, we must both model the behavior ourselves as well as instigating strong guidelines across the community, lest people burn out and hurt themselves (or others). 

I struggled to do this for myself and those around me during digital response campaigns earlier in the 2010s, saw better success as more coordinators came online and came up to speed around 2015, and saw the best example yet during Occupy Sandy response in 2012.

Bringing joy

Take time and space to notice the things that bring you joy, make you pause to pay attention, shake your preconceived notions, or inspire those around you? Laughter and joy are important things to experience during a crisis, even though it may feel inappropriate at the time. This is something we can give to one another: time to stop and experience.

Embed assumptions into everything else

Everyone is always jumping from topic to topic as priorities change during a response. As systems fall into place, people start making notes in their “space” – whether physical space (as pictured above), in onboarding docs, or as reminders present in digital communication. Self-care guidelines should be included in this, along with an explicit expectation that people support each other if someone is struggling to follow community care guidelines. They may already be facing internal shame for not modeling the behavior.

For example, rotation of duties is an excellent way to build resilience of responsibility in your community and to strengthen the overall system by knowledge sharing. Taking at least one day off a week is a necessary additional example. Both come at a cost – a maximum of 5 days in one’s speciality – but the overall benefit to the system is well worth it.

Lead by obeying

You cannot go all out indefinitely and your body, relationships, and work will suffer if you try to. If someone (including you) is unwilling to take care of themselves, there is likely either a codependent need to be valued that needs self reflection, or they may be more interested in being seen as heroic than in actually being effective or modeling care for others, and that should be avoided. Life will continue after the crisis, and you have to have things worth going back to, that hopefully you’ve been able to enjoy and maintain in the meantime.

Pushing power outwards

Look for people invested in the cultural context of the group you’re working in. They will foster the emotional safety that will allow you to take informed risks. Look for people who make space for others, and ask them to lead. Quiet, competent leaders are often overlooked in favor of those who are brasher. However, the quiet, competent people can also be the most skilled at delivering on group goals while also uplifting the group. 

Those folks can be quiet, though! And quiet people sometimes like quiet spaces. Having a “sacred” quiet space to go amongst the chaos of response can help people recenter themselves and find balance. It’s a good place to practice gratitude and pause to be strategic rather than reactionary.

Support your leaders, IE if a quiet, competent leader is also a single parent, find a way to get them child care support while they coordinate your group. Additionally, it is a full time job to support the frontline workers. Those support roles ALSO need support and can succumb to burnout.

Data security in crisis situations

Shout out to Baron Oldenburg and Eleanor Saitta for feedback on this post!

Information is flying around fast and loose as you try to help people in need. Anyone who has capacity to help has been added to a spreadsheet tracking needs. If you’re in the thick of it, this piece isn’t for you yet. But even in those moments, be careful about who you share sensitive data with – there are big ramifications later if you get it wrong.

But when you can come back and slow down a little bit to think about the longer-term ramifications of data, you should come back and investigate this. Because while getting people the immediate help they need as quickly as possible is more important than keeping their data safe, the long term impacts of a data leak could put people already in harm’s way further in harm’s way. Example: collecting immigration status when determining which shelters will work for which folk could open you up to a subpoena or backdoor that leaks the data.

So far, I don’t know of any data breaches from community-led crisis response, but it’s frankly a second disaster waiting to happen. People offer admin access to EVERYONE involved in order to feel equitable. People are then scared to remove admin access to things because they don’t want to upset anyone. This leaves a very large attack surface for something to go wrong even beyond the flaws of the tool itself. So limit how many administrators you have, and have a regular cadence to check in on who has access as an admin and otherwise. Set up an impersonal rubric to remove access (“hasn’t accessed this data in x days” or “we’ll only have 3 admins, and we talk monthly about who is best in those roles” are two examples). 

To limit the impact of a data breach, collecting ONLY necessary data is the best way to design. You don’t need to be collecting demographic data unless you’re running an equitability study later. Example: address and risk level shouldn’t be cross referenced unless absolutely vital. 

Do not use one shared login for vital or administrative accounts. Most tools worth their salt will allow you to have multiple accounts log in for the same view, so set people up with individual accounts so the account access can be managed. Any person with a shared login will be able to change it for everyone else. 

Retrofitting later is a pain, but is worth the pain. If you’re in a place where you can migrate to a new tool for a longer-term vision, I’d recommend mapping out tool options against group considerations. I do a grid with rows for technical options, and columns for things I care about. Things like longevity of data, alignment of the org with your group’s politics, who the data is visible to, if the data can be sold to external parties, relationship with law enforcement, etc. I then indicate how aligned with my goals each option is, and discuss the resulting grid with the rest of the tech team. Here’s an example grid for picking which messaging platform to use with each other:

If you’re able to turn on multifactor authentication (MFA), that’s another point where you can limit who the admins are. Doing this can slow some things down and be at odds with people being able to take the day off, but it’s another vector along which security can be tightened up as things slow down in the response. 

As an individual thing, Google Advanced Protection is worth turning on if you’re using Google tools. If you’ve got a workspace domain that’s being used in the response, all the admins should have it on, even if you’re just using people’s personal ad hoc accounts for most of the response work. We’re generally in favor of keeping data in Workspace even for many sensitive NGOs in complex situations because it keeps it off of individual devices and out of chats/email where it’s hard or impossible to purge, update, or track access. This of course presumes you have good connectivity, but so do most of these tools.

If you do have to have shared accounts for some things, using a password safe that gives you shared vaults can let folks log in without having direct access to the password if they’re willing to install the plugin — mostly for third party logistics or data feeds or whatever, not for the primary collaboration tools.

What else should folks be doing?

Spontaneous Unaffiliated Volunteers

Anytime there’s a crisis, there’s a flood of people showing up to help. They’re called “spontaneous unaffiliated volunteers” (SUVs) in crisis response circles, and they’re generally considered a chaos amplifier. They’re mostly seen as getting in the way, of being untrained and untasked, and often as not being willing to be trained or tasked.

And at the same time, the amount of work to be done is huge, and there are never enough hands. These folks have dropped everything in their lives because their hearts have been broken open, and they are here to help.

So how to manage this?

When people show up, they are either there to help, or there to “help.” They are either there to serve others, even if it means digging the latrine pit; or they are there to feel better about themselves. Discerning this early on in your intake flow is vital. One way I’ve seen to do this so far is to give someone a task that is not very important (but still engaging) and see what they do with it. If they deliver on it and ask for more, they’re good to go and you can give them more visible things. If they dawdle, take lots of selfies, and ask for other work; redirect them to things that keep them out of the way like sorting and keeping things tidy. They’ll usually phase themselves out.

What are other ways to discern between these groups?

Arc of disaster response

There’s this standard graph of needs versus resources that emergency managers use.

A chart with two lines. X axis is time, Y axis is level. A red line indicates need, which starts flat, then quickly rises and then slowly dips before restabilizing. A blue line indicates resources, and also starts off steady but dips quickly after a crisis point. It rises until it is over the dipping need line, then restabilizes alongside the need line.

It indicates that needs for an area are usually pretty steady, but when a disaster strikes, needs rise. Needs rise because some resources are destroyed and because people are distressed and injured (needing more resources than usual). 

It also indicates that access to resources diminishes but then sees a huge surge in delivery, which then falls off. Access to resources fall when the infrastructure to maintain (like refrigerators) and gain (like a grocery store) might be out of commission, but then rise as external resources flow into the area, and then level off again as infrastructure is regained and external attention wanes. 

This is also aligned with what I’m theorizing is the arc of engagement. In this, frontline populations (hey that’s you!) are ALWAYS the first to respond. As official response comes in, frontline populations can take a bit of a breather, but then step up again for the transition from official response to the new normal. 

This also leads to some tensions – official response, while well practiced and educated in how to do response in general, do NOT know about the specifics of your region or your community’s needs. There are some time periods where you will need to show up and advocate for your unique situation, even if people providing you much needed resources struggle to listen. We are writing them a guide in HOW to listen, but YMMV. 

The place you come in best while official responders are here are in last mile logistics and data. They will be deploying to large parking lots and trying to get people to go there to pick up resources and detail damage. You can gather that information from your at risk neighbors and coordinate with all your neighbors about which resources to prioritize, then bring that to the official responders.

Pablo

I was going to have lunch with Pablo and Janot in two weeks.

I met Pablo through John Crowley, as a part of the Boston area humanitarian and disaster response gang. He was instantaneously one of my favorite people – intense, warm, and utterly fixated on making things Better. He had somehow landed a gig with the International Red Cross Red Crescent teaching about climate science and probability through game mechanics.

He taught me that I didn’t need to be so serious in my approaches. He taught me people are willing to be vulnerable if you provide them some scaffolding and simply ask them to dive in, assuring them that uncertainty is a part of all that we do and that not knowing how to play the game couldn’t prevent you from playing it.

He helped me, the anxious, risk-averse, hermit that I am, not only take risks, but ask others to do so as well, and to make the whole thing playful. Of COURSE you strike out sometimes, that’s how probability works. Of COURSE it’s not a reflection on your moral character when you strike out in a game or on a project, that just means you’re trying new things.

He died unexpectedly weekend before last. There are now nearly 500 of us in a wide-ranging international WhatsApp group trading stories of how he touched us and changed the world for the better.

For me, there are four main times that stand out.

Continue reading