UNITED STATES OF AMERICA
|
Draft Interagency White Paper on
|
FRS Docket No. R-1128 OCC Docket No. 02-13 SEC File No. S7-32-02 |
Mary Ellen Burns
Assistant Attorney General in Charge
Bureau of Telecommunications and Energy
Keith H. Gordon
Assistant Attorney General
Of counsel
120 Broadway
New York, New York 10271
Tel No.: (212) 416-6343
Fax No.: (212) 416-8877
E-mail: keith.gordon@oag.state.ny.us
January 30, 2003
In the wake of the September 11, 2001 terrorist attacks on New York City and the Pentagon, the U.S. Federal Reserve System, the Comptroller of the Currency and the Securities and Exchange Commission, in conjunction with the New York State Banking Department ("the Agencies"), released a draft white paper ("White Paper"), on August 30, 2002, proposing standards to ensure the rapid recovery ability of critical participants in the US financial markets in the event of a future catastrophic event. The Agencies have sought public comment on these proposed requirements.
The Agencies' effort to identify sound practices that will ensure the functioning of the nation's key financial markets following a severe disruptive event such as occurred on September 11, 2001 is critically important. At the same time, this office has grave concerns about one proposal, which would have firms establish "out-of-region" backup facilities to ensure their rapid recovery capability. As a practical matter, this proposal would require key firms to remove major operations hundreds of miles from their current primary offices. In addition to being impractical to implement, it would likely have an extremely deleterious impact on New York City, especially downtown Manhattan.
Establishing backup operations and redundant communications systems, as well as emergency protocols to deal with future disaster scenarios is vital to the security of our financial markets and the nation. As noted by the comments submitted to date, most New York City based and other US businesses are already doing a tremendous amount of additional planning and systems-strengthening, in the wake of September 11, to ensure the continuity and resilience of critical market operations, without government mandate. This includes creating more backupsystems and other redundancies, especially telecommunications capabilities. Some downtown Manhattan firms affected by the World Trade Center attacks have moved operations to midtown, to other parts of the metropolitan area, or elsewhere.
While the White Paper couches its requirements in general terms seemingly applicable across the country, in fact, its consequences will be chiefly felt by New York City, because, as the financial capital of both the nation and the world, New York City is home to most of the key entities required to take preparedness steps.
The Agencies should pay close attention to the comments of New York-based financial firms, government agencies and business associations which experienced the events of September 11 firsthand and have critical expertise and judgment about how best to achieve the Agencies' important preparedness goals. Most of the entities question the feasibility, practicality, cost-effectiveness, and desirability of establishing and maintaining standby backup offices far away from their central offices. Some, such as the City of New York, argue persuasively that the City itself is best positioned in terms of experience, resources and planning capability to respond to a future major disruption, as it did to the last. The Agencies' important effort certainly does not and should not require the transfer of thousands of New York-based jobs, to the economic detriment of a city, state and region seeking to recover from the very terrorist attack that prompted the White Paper.
As an office that not only regulates the New York securities industry but is also a part of downtown Manhattan, with offices a block from the World Trade Center, we urge the Agencies to reject the White Paper's out-of-region backup facility proposal. We pledge our best efforts to work with all interested parties to achieve a result that satisfies national security goals, whichplainly include New York City's continued vitality as the global financial capital.
The White Paper seeks to "ensure the resilience of critical financial markets" in the wake of the September 11, 2001 terrorist attacks by requiring that "core clearing and settlement organizations and other firms that play significant roles in critical financial markets ... be able to perform their critical activities even in the event of a wide-scale regional disruption," namely, a severe disruption of critical infrastructure elements such as transportation, telecommunications, or electric power to an economically integrated metropolitan area. The White Paper, without specifying any individual firm, refers to "core clearing and settlement organizations" and "most of the 15-20 major banks and the 5-10 major securities firms" as the key entities to which the proposed "sound practices" would be "most applicable." These sound practices are intended to ensure that critical financial markets could recover and resume critical operations, such as processing and clearing, "within the business day" of the disruptive event, with a recommended time of four hours.
The White Paper recognizes that most of the key firms involved "enjoy the benefits of operating out of major financial centers." This is an understatement. It is almost surely the case that most of the affected firms have their "primary site" in New York City, and within New York City, in downtown and midtown Manhattan. New York City has the greatest concentration of key financial institutions in the United States, a matter that did not escape the attention of al Qaeda in planning the attacks on the World Trade Center. Thus the White Paper's out-of-region backup facility proposal must be read in the light of the major impact it would have on New York City.
Under the sound practices discussed in the White Paper, firms would identify critical functions and processes, recovery-time targets, recovery planning and testing, and, most significantly, would create "out-of-region operations and the personnel and data that support them." These out-of-region standby operations are not to be "dependent on the same labor pool or infrastructure components," including telecommunications, transportation, electric power, and water supply, as "the primary site," and should not be "affected by a wide-scale evacuation or the inaccessibility of the region's population."1
If imposed, these criteria would require movement of backup facilities out of the entire New York metropolitan area, which shares at a minimum a skilled labor pool and interconnected transportation services. Any such directive would spur further large-scale dispersion of business offices and jobs to locations outside the New York metropolitan region, and could even lead to key financial firms discontinuing some operations or moving out of New York City altogether, due to the costs of maintaining standby operations.2 Given the importance of the financial sector to New York City, such a turn of events could cripple the City economically3 and severelydamage the nation's standing, in favor of London, Tokyo or other overseas financial markets. Surely the Agencies do not intend this result.
The White Paper's ill-conceived proposal for the establishment of out-of-region operations fails to take adequate account of real-life circumstances and is not necessary to achieve the stated goal. For example, commenters point to the costliness and impracticality of maintaining separate labor pools, noting that "a sufficient pool of well-educated and motivated workers is difficult to locate and maintain outside of major metropolitan areas."4 Commenters observe that "because it is not practical to quickly relocate staff hundreds of miles, nor to maintain them for prolonged periods at distances far removed from home and family during a period of regional crisis, it is clear that contingency sites for staff must be located within the same region as their primary workplace."5
Having a dormant secondary site to be activated only in the event of disaster at the primary site is inefficient and a competitive burden. Furthermore, financial institutions that currently operate dual transaction processing sites through data mirroring and simultaneous processing systems point out that such arrangements are currently limited to distances of less than 100 kilometers of fiber routing (which, because of the indirect routing of fiber networks, isoften considerably shorter than highway or air distances).6
Commenters also cogently note that "the potential circumstances that would legitimately require backup hundreds of miles away are extreme and improbable, and may not always warrant the logistics and expense of installing such remote backup provisions."7 New York-based firms are leading the disaster planning effort, as the White Paper recognizes, and have already taken systematic and costly steps to ensure redundancy and resilience in the face of another catastrophe. Having been among those most affected by the events of September 11, 2001, New York-based firms have firsthand knowledge of the critical need for emergency planning, as well as the most hands-on experience in the country in actually responding to a major terrorist attack. Their concerns for cost, practicality and feasibility must be taken seriously.
The White Paper concedes that any "one-size-fits-all" solution would not be appropriate. This is a crucial fact, which dictates that regulators take into account differing conditions and circumstances in various parts of the country. New York City's unique circumstances demonstrate this imperative most dramatically.
New York City's comments demonstrate in detail that the infrastructure that exists in the New York metropolitan area is tremendously robust and diverse, and capable of supporting the recovery of financial markets in the event of another major disruption. Indeed, long-term investments by public entities and private enterprise were of tremendous value in enabling NewYork City and its financial institutions to recover from the unprecedented devastation that took place on September 11, 2001 in a rapid and coordinated manner.
Reliable telecommunications service is "by far the most critical"8 requirement for major financial institutions to operate in today's high volume rapidly changing economic environment. Telecommunications capability encompasses all the communications connectivity required by financial institutions and markets, including voice and data communications of very sophisticated and complex sorts, without which today's markets could not operate.
New York City leads the nation in its concentration of facilities-based telecommunications service providers serving large business customers9 precisely because of the presence of so many major financial institutions in Manhattan. (New York City business customers attracted the first competitive providers as far back as the 1980s primarily because this telecommunications market is the most lucrative in the nation.) When the collapse the World Trade Center severely damaged Verizon's adjacent central office located at 140 West Street, the presence of self-healing SONET fiber rings, microwave transmitters and other technology employed by competitive local exchange carriers proved to be of enormous benefit in expediting service restoration for Manhattan financial institutions. Because New York has long encouraged the development of competitive local telecommunications services, affected businesses were able to call upon multiple carriers' facilities to replace those destroyed by the World Trade Center collapse, thereby greatly accelerating the recovery and business restoration process.
A post-recovery analysis performed by the Lower Manhattan Telecommunications Users' Working Group found that "the telecom outages suffered in Lower Manhattan after the attacks were a result of an under-appreciation of potential failure points rather than a deficient telecom infrastructure" and that measures taken during and after the recovery effort have made the district "more redundant, resilient and reliable than before the attacks."10 The financial district of Manhattan is now served by six distinct fiber optic networks, yielding more redundancy options than anywhere else.11 As one of these networks is provided by Con Edison Communications, a carrier-neutral provider, business customers in Manhattan now have the opportunity to purchase circuits routed through below-ground conduits separate from those of Verizon, greatly increasing redundancy protection.12
The second most essential infrastructure facility of critical importance to financial market recovery is the provision of continuous electrical service. Again, New York City's real world experience demonstrates that sound design and planning can minimize power disruption forcustomers and key industries. Even though two major power substations serving lower Manhattan were destroyed by 7 World Trade Center's collapse, other nearby substations were unaffected, which meant the power stayed on for many businesses. Consolidated Edison, the electric power utility, was able to respond quickly to maintain electric service for most of Manhattan. Furthermore, by connecting temporary feeders to other nearby substations and adjacent electrical distribution grids, Con Edison restored essential power supply to all key financial industry operations in near miraculous time. The New York Independent System Operator, which operates the electric power grid and wholesale power markets in New York State, ensured that service to the rest of the City and the State was unaffected even when the collapse of the World Trade Center towers suddenly removed 100 megawatts of electric load from the system.
Other essential services supplied by the New York City and State governments, including public authorities, such as subway, rail, bus and ferry transportation, bridges, tunnels, and airports, water supply and sewer service weathered the storm remarkably well. By quickly restoring subway service to stations not damaged by the collapsed buildings, New York City Transit enabled workers displaced by the disaster to commute to alternate job sites with minimal difficulty. The loss of the World Trade Center PATH station connecting lower Manhattan to New Jersey was alleviated by midtown Hudson River train tunnels and increased ferry services from New Jersey to multiple points along both the Hudson and East Rivers.
In sum, "[t]he resilience and emergency resources of the entire business and residential communities in New York City were pivotal to restoring the city's infrastructure and enabling thecity's financial functions to recover rapidly from the disruptions of the terrorist attack."13
The successes in New York City's response to the World Trade Center attacks do not mean that significant problems did not come to light following the attacks or that disaster preparedness cannot be improved. For example, some businesses previously thought to have adequate telecommunications redundancy learned that having two circuits traveling in the same conduit or even in different conduits to the same switching office did not provide adequate protection. Similarly, onsite backup electric generators were found to pose risks as well as benefits, as demonstrated by the role that diesel fuel storage tanks reportedly played in causing 7 World Trade Center to burn and collapse, taking the New York City disaster emergency command center with it.
In short, as other parties have noted in their comments,14 the successes and shortcomings experienced in New York City; Arlington, Virginia; Oklahoma City and other disaster sites teach government and private businesses important lessons that should be incorporated into ongoing preparedness plans. Whether the cause be a terrorist, a hurricane, or an earthquake, each new disaster increases the knowledge pool and improves the ability of disaster planning to make better preparations for the future.
For many businesses, the most feasible solution to rapid disaster recovery is to plan for alternate facilities to be available within the same geographic region as the primary site.15 Thisenables the same work force to staff both the primary and backup sites with minimal disruption.16 Such a solution calls for a metropolitan region with multiple commuting options, such as New York City, so that employees can use trains, subways, busses, ferries and automobiles to reach the secondary site even if individual transportation links are disrupted.17 So long as a company's disaster response plan has taken into account such necessities, the standards adopted by the Agencies should recognize such contingency plans as adequate.
The need for sound planning to prepare for the possibility of a major disaster affecting the financial industry is clearly an appropriate subject for analysis by both federal and state regulators. However, great care must be taken to ensure that the cure does not do more harm than the anticipated threat. Nationwide generic resilience standards cannot be imposed without recognizing the real world consequences they would have for the specific firms and geographic centers that would be affected. The security problems facing financial firms have multiple solutions and what may work in one location or for one company may not be practical or effective in another location or for other companies.
The Attorney General agrees with the many parties who have urged that the Agencies avoid adoption of rigid standards and instead allow the affected firms to make an individualized cost-benefit analysis of the most suitable disaster readiness plan that suits particular needs andcircumstances.18 The Agencies must keep in mind that the financial services industry is composed of highly competitive private businesses which operate and compete on a global scale. This circumstance is a two-edged sword. On the one hand, regulatory obligations adopted in the United States that prove too burdensome pose the risk that affected businesses will shift more of their operations to other parts of the world, thereby disadvantaging those American firms which choose not to do so.19 On the other hand, as pointed out by several commenters,20 multinational firms may already be in a good position to adjust to a disaster affecting their primary American operation, without creating new facilities, by temporarily shifting their essential operations to overseas offices that already perform similar functions.
Another potential adverse consequence from adoption of rigid standards is that "[c]ertain firms in some markets that are on the margins of [the Agencies' policy rule] may want to exclude themselves . . . [resulting in] further market concentration and increased liquidity risk."21
All of the forgoing discussion leads to the conclusion that no simple national disaster response standard or policy would be appropriate or practical. While setting recovery goals is useful to guide institutions in their planning efforts, individual circumstances differ so widely from one company to another, even within a single sector of the financial services industry, thatthe only worthwhile approach is to address the requirements and needs of each entity individually. As noted by other parties,22 such a case-by-case approach is by far the most practical means by which the Agencies can help strengthen the financial industry's resilience to natural or other disasters.
The Agencies should continue their crucial disaster preparedness effort by working with key financial institutions, government agencies and officials, and business associations in a constructive manner while taking care to avoid adverse economic impacts on existing business centers, especially New York City.
Dated: New York, New York
January 30, 2003
| Respectfully submitted, ELIOT SPITZER
By:_________________________
| |
| Mary Ellen Burns
Assistant Attorney General in Charge Bureau of Telecommunications and Energy Keith H. Gordon Assistant Attorney General Of counsel |
120 Broadway, 25th. Floor New York, New York 10271 Tel No.: (212) 416-6343 Fax No.: (212) 416-8877 E-mail: keith.gordon@oag.state.ny.us |
____________________________
| 1 | The White Paper even suggests that "200 - 300 miles" might be an appropriate minimum distance between the "primary site" and the backup site. This specific proposal now appears to be off the table. See Letter from Alan Greenspan, Harvey Pitt, and John D. Hawke Jr. to the Honorable Charles E. Schumer, Dec. 23, 2002. |
| 2 | See, e.g. Comments, The Financial Services Roundtable, "...mandating out-of-region backup sites could result in some financial institutions being unable to continue operations in core businesses and/or those that may be of strategic importance to them." |
| 3 | See, e.g., Comments, Alliance for Downtown New York, The Association for a Better New York and The Real Estate Board of New York. |
| 4 | Comments, Citigroup Inc., Credit Suisse First Boston, Deutsche Bank AG, Goldman Sachs & Co., J.P. Morgan Chase & Co., Lehman Brothers and Merrill Lynch & Co., Inc.. |
| 5 | Comments, The Bank of New York. |
| 6 | See e.g., Comments, Charles Schwab Corporation; Comments, Citibank, et al.; Comments, Financial Services Roundtable/BITS; and Comments, Mellon Financial Corporation. |
| 7 | Comments, The Financial Services Roundtable/BITS. |
| 8 | Comments, The Bank of New York. |
| 9 | See Federal Communications Commission's December 2002 Local Telephone Competition Report, http://www.fcc.gov/Bureaus/Common_Carrier/Reports/FCC-State_ Link/IAD/lcom1202.pdf. |
| 10 | Building a 21st Century Telecom Infrastructure: Lower Manhattan Telecommunications Users' Working Group Findings and Recommendations, August 2002, p. 4. The working group members include American International Group, the Bank of New York, Brown Brothers Harriman, Deutsche Bank, Goldman, Sachs & Co., Guardian Insurance, Federal Reserve Bank, New York Mercantile Exchange, New York Stock Exchange, Morgan Stanley, Rudin Management Co., Standard & Poors and Sullivan & Cromwell. |
| 11 | Id. |
| 12 | Id., p. 5. It must be noted that, even though Verizon's switching office, the largest in the nation (serving 6.6 million data circuits and 200,000 voice circuits), was heavily damaged on September 11, the nearby presence of other Verizon switches at Pearl Street and Broad Street (both within the lower Manhattan financial district and within walking distance) meant that much communication never failed or was restored relatively quickly, given the immense and unprecedented nature of the disruption. |
| 13 | Id. |
| 14 | See Comments, Citigroup Inc., et al. |
| 15 | Ibid. |
| 16 | See Comments, Bank of New York. |
| 17 | See Comments, The Alliance for Downtown New York, et al.; and Comments, New York City. |
| 18 | See e.g., Comments, Financial Services Roundtable/BITS; and Comments, Mellon Financial Corporation. |
| 19 | See November 12, 2002 Comments, Options Clearing Corporation; Comments, American Bankers Association and ABA Securities Association (expressing concern about global competitive implications if standards adopted by the Agencies are not consistent worldwide); Comments, Citibank, et al. |
| 20 | See Comments, Lehman Brothers Holdings, Inc. |
| 21 | See Comments, Citibank Inc., et al. |
| 22 | Ibid. |