States push feds to 'harmonize' cybersecurity regulations in 2018
January 19, 2018
New advocacy priorities released by the National Association of State Chief Information Officers shows a continued push for simplified regulations.
Working out of the city's emergency operations center, Chief Information Officer Rosa Akhtarkhavari recalls a tragedy that tested the city's expertise and emotions.
Colin Wood is the managing editor of StateScoop. Before that, he was a staff writer for Government Technology magazine. Before that, he taught Engl...
On June 12, Rosa Akhtarkhavari started her day early. She hadn't been watching the news, so she didn't know about the long hours and emotional turmoil that awaited her.
She was just a few minutes behind the rest of the world, which was getting to know Omar Mateen.
Acting in the name of the Islamic State of Iraq and the Levant (ISIL) and equipped with a 9mm Glock and SIG Sauer MCX — a quiet rifle used by U.S. special forces — Mateen entered Pulse, a popular gay nightclub in Orlando, Fla., and fired more than 200 rounds, killing 49 people and injuring another 53.
It was the deadliest terror attack since Sept. 11, and the nation responded. Reactions on Twitter reflected what people were going through offline — feelings of disbelief, anger and pain accompanied calls for gun control and political commentary. While the public faltered, Orlando's public safety community had a job to do.
So did Akhtarkhavari.
As Orlando's chief information officer, it was her job to ensure the city's emergency response workers and administrators had the technology they needed.
Raised in Jordan in the Bahá'í Faith — a religion characterized by its emphasis on unity and equality — Akhtarkhavari said the hardest part of living through that time was coming to terms with how someone could act from a place of such cruelty and hate.
“This, to me, was the one thing I was not prepared for,” Akhtarkhavari said. “I had participated in emergency response before. We practice. We plan. The one thing I was not prepared for was the emotional stress and being able to process, 'This is really happening. This is happening in our back yard. Forty-nine people have been killed and it could be a co-worker or someone I know, or a family member.’”
The City of Orlando operates an emergency operations center (EOC), where Akhtarkhavari and IT support were among the first to be activated a few hours after the shooting stopped. In 2004, the city used the center to organize operations as Hurricanes Charley, Frances, Ivan, and Jeanne battered the Eastern seaboard. This year, it was Pulse.
Adjacent to the 911 dispatch center, the EOC houses tables, computer equipment and phones, neatly staged. When emergency responders make demands with deadlines of minutes, there's little time to connect wires or watch progress bars tick onward.
During a hurricane, for example, Akhtarkhavari’s job is to provide IT support to the call center and deliver geographic information system (GIS) services for better visibility. She must stay in contact with the 911 system, police, fire, the damage assessment team, storm water workers, and vendors so the city can obtain information as quickly as possible, communicate effectively and keep the public safe.
As Akhtarkhavari provided IT support in the days that followed the Pulse nightclub shooting, prior obligations and unexpected technical challenges piled extra layers of stress onto what was already one of the most difficult situations a city could face.
Not an IT Function
Akhtarkhavari said her biggest worry before the shooting was an upcoming computer-aided dispatch (CAD) system procurement.
When she arrived at the EOC around 9 a.m., the 911 call center was overloaded. The names of the dead had not yet been released and people wanted to know what was going on. She called two staff members who lived close to the EOC and together they activated the staged call center to ease the load on 911.
“We checked the equipment, we checked the wireless support, we checked the phone lines and we refreshed our GIS and we were ready to support as needed,” she recounted. “Those were the first tasks.”
Many of the calls the city received were from Spanish-speaking people, and right away, Akhtarkhavari said, they realized that not only did they not have enough phone lines, but they didn’t have enough Spanish-speaking call takers either.
“Everybody was calling the emergency center and we had police and fire answering, but they actually pulled the IT staff who were supposed to be desktop support to help take those calls of the mom crying, saying, 'I don't know if my child is dead or alive,'" Akhtarkhavari recalled with a pause. "Not an IT function.”
Early on, Akhtarkhavari found herself taking on a new function — delegating tasks to workers not because of their technical skill sets, education or training, but based on temperament.
“Police, fire, they're trained to deal with that emotional stress,” she said. “Being in the same room with the police chief and the fire chief and hearing some of the stories… For me to be able to function and do my job effectively, I needed to disconnect emotionally. What happened still impacts me.”
The call center started with about 10 phone lines, which the city also recognized early would not be enough, so the city scaled up to 47 lines, which was still less than they needed, she said, but a huge improvement.
"We opened a family assistance center," Akhtarkhavari continued. "At this point, we were dealing with the coroners and the regional support teams, so we had to give them all the right technologies. We had to give them connectivity, phone lines, we just had to enable that team to do their work. The next day we actually had to move the assistance center to another location to provide the connectivity that was needed.
"Because we were dealing with regional, national, state and non-profit entities, we were starting to deal with the families, so we had an intake process that we had to put together, and we needed to have phone lines, and a separate full technology-enabled facility."
Akhtarkhavari estimated she worked an average of 15-hours per day the next ten days. She recalled the dedication of her team, who she said were eager to work nights and weekends to help their city. The team stood by, providing IT support to emergency services and addressing new problems as they arose.
“Everything that's scheduled, we still needed to meet the deadlines, we had to make decisions and prioritize. Do we cancel events and scheduled functions or not?” she said. “How do we deal with the flood of emails? How do we deal with the flood of social media? This is what we were dealing with. When do we update the city website to include the release of the names of the victims, and how do we respond to the large number of inquiries and messages? I've been in IT forever — for 26, 27 years. This was different.”
The extreme nature of the event created situations she and the city had never experienced before. At 11 p.m. one night, the city press secretary's email address was erroneously flagged as spam because of the bulk of emails flying out within a 24 hour window.
Akhtarkhavari also discovered it fell to her to coordinate a huge number IT staff and vendors. Everyone wanted to help, she said, so she had to control exactly which task each person would be responsible for and then grant access to the relevant locations and resources.
Events like the mass murder at Pulse illuminate the unique mindset that people who work in public safety so frequently adopt. Most hope that senseless mass killings won't simply continue unabated, but public safety officials aren't known for entertaining those wistful feelings longer than a moment. Their job is one of pragmatism, to make sure that if it does happen again, they're better prepared than they were the time before. The city's response to Pulse revealed how Akhtarkhavari's tool kit was working and where it needed improvement.
Despite not having enough phone lines initially, the city was able to scale up quickly, Akhtarkhavari said, and that was largely thanks to their vendor relationships and cloud-first approach.
"The trust and partnership I have with the businesses [was critical]," she said. "And the trust and partnership I had with my vendor was beyond transactional, because a transactional relationship doesn't work during a time of crisis."
The emergency revealed how the city's strong relationships had been buttressing their technologies. When thousands began pouring in online to find information, the city's website didn't blink, she said.
"We have infrastructure as a service hosted off-site and that's not something the city could scale. And we have content caching, so all of those hits from all around the world were able to be managed by our content caching vendor. That took away the major obstacle that would have made us crash and burn. Thankfully, we didn't have to worry about it."
Thanks to Microsoft's crisis team, Orlando was able to launch a website for the OneOrlando fund within 24 hours. The city wrote the application, but with little Azure publishing experience, they relied on the vendor to tweak the code and guide the city through the publication process so they could begin collecting donations as soon as possible.
The magnitude of the disaster also made the CIO realize the importance of having staff who are intimately familiar with the organization. Akhtarkhavari has been employed by the City of Orlando for 24 years, so she knew where to look and who to ask when she needed something. Likewise, the institutional knowledge housed in the minds of other city veterans proved to be an unparalleled resource.
One thing the city is going to change as a result of the shooting, she said, is a more clear explanation of what role IT staff members will play should a similar event occur again. Today, Akhtarkhavari's office only supplies parts of the city full-time support, like police. Everyone else is on standby.
"It was very hard to find the full staff I needed during the response," she said. "I had to call multiple people within each function to find someone who could just drop what they're doing and come."
Despite the challenges they faced, Orlando excelled where more rigid organizations may have floundered.
"This is what made me proud," she said. "That our strategy of resilient and scalable solutions, at least in certain cases, worked very well for us."
A Response With the Heart
Akhtarkhavari relayed feelings of pride and thankfulness for those who helped during the recovery process.
"The importance of IT being in the emergency operations center became clearly apparent, because there was no time for anyone to come and ask you for help," Akhtarkhavari said. "You need to be sitting as the discussions are happening and you can say, 'I'll take this task.' You're not just sitting on the edge and waiting to be tasked. You are part of the solution.
“I was looking the fire chief in the eyes when he discussed the removal of bodies from Pulse, and listened when he said his main concern was to preserve the dignity of the victims and their families," she said. "It makes you proud to even be part of the city. The discussion was not mechanical, task-oriented. It just was really a response with the heart.”
Proximity to tragedy amplifies impact, but Akhtarkhavari said the experience triggered a personal connection that transcended her residence in Orlando. A Bahá'í, Akhtarkhavari remembered attending Catholic school, having friends from all different religious backgrounds and everyone being "extremely nice." But it wasn't like that everywhere.
"My parents are Persian and growing up during the revolution, up until today, Bahá'ís in Iran are still discriminated against for their faith," she said. "My dad's cousins were executed for their faith and I had to live listening to those stories."
In her early 20s, Akhtarkhavari moved to the U.S. for the same reason America's founding fathers did — religious and ideological freedom, promise of a better life and the expectation they could dance without being shot.
"So, to me, it's personal," Akhtarkhavari said. "Treating people differently because they are different is just not acceptable."