“There will be a time when an outage occurs due to a major solar flare, terrorism or human error, lasting weeks or months on a regional or national level,” Lynbrook Village Administrator John Giordano told Government Technology.
The village officially adopted its Internet Outage Continuity Plan on Sept. 12, 2022, and has distributed copies to all departments. The document is intended to supplement other disaster recovery and business continuity plans. It maps out every function conducted by local government, identifies those involving Internet and lists alternative, offline methods of getting the job done.
To Giordano’s knowledge, theirs is the first municipal Internet outage plan in the state.
He said that while prolonged Internet loss sounds unlikely, so did the pandemic.
“COVID – that was a big inspiration for this,” Giordano said. “… Nobody thought COVID would happen and this [long-term Internet loss] seems to be more realistic than what anybody would’ve thought COVID would be a year before.”
Lynbrook spent about four months convening department heads to discuss ideas and develop its plan. It gave a copy to the New York Conference of Mayors, for sharing with other interested local governments.
Should an outage occur, the village aims to be ready.
“When it does happen, there is a need to act right away, instead of trying to reinvent the wheel,” Giordano said.
WHEN THE INTERNET GOES OUT
Recent years have given communities a taste of Internet loss. For example, a July 2022 outage at major Canadian Internet and mobile provider Rogers Communications caused card payments to fail, saw a trial hearing delayed over video-conferencing issues and impeded residents’ abilities to call for emergency services. Rogers attributed that incident to a maintenance upgrade. In 2021, human error also prevented U.K. residents from accessing many websites.
And — as Mississippi State University Assistant Clinical Professor of Electrical Engineering David Wallace writes — a significant solar flare could disrupt Internet and electricity.
Lynbrook isn’t the only government concerned, and many counties include Internet loss in their own continuity of operations plans, said Rita Reynolds, CIO of the National Association of Counties (NACo). In her experience, these plans tend to look at a shorter time frame, envisioning outages that last weeks or months, but not half a year. Discussions over how to handle such an outage have become more frequent, too, as government cloud adoptions rise.
“This definitely has been on the mind of counties, and they recognize that there needs to be backup solutions, but beyond that, even some other approaches,” Reynolds said.
RETAINING, RESTORING INTERNET
Alongside planning for a loss of Internet service, governments are also aiming to stave off such events in the first place.
Reynolds said some counties’ contingency plans include backup methods of Internet access, should connectivity only be downed for government buildings, while remaining available in the surrounding area. That could happen if an animal chewed through Internet cables, for example.
In response, counties might switch to a second provider or other type of connection.
“Some counties have backup Internet connectivity, through maybe a Metro-E [Ethernet] circuit or an alternate … you could have a Verizon connection, but your alternate is a Comcast cable connection. While the speed might not be as fast, you still have an alternative for those types of outages,” Reynolds said.
The Lynbrook plan anticipates many months of offline services, but Reynolds said county governments facing such extensive outages may be able to relocate to regain connectivity. Should natural disasters destroy entire government buildings, officials may be able to move to backup facilities that have retained online access.
Cyber best practices also call for maintaining offline data backups in physically separate locations, which governments could turn to when key records become no longer available to them online. Governments transitioning to cloud should still maintain such backup practices, Reynolds advised, though they may be able to manage with only doing so for essential assets, like financial databases.
OFFLINE CONTINUITY
Still, governments’ best efforts may not always be enough, and keeping operations running could mean ensuring older technologies like landline telephones and faxes remain an option, even as governments acquire modern tech.
“The reality is that counties know they have to be prepared to go, as we call it, ‘old school’: paper documents, manual forms that they used years ago — you still have to keep some,” Reynolds said. “… While we are eliminating [paper] to a great extent in our society and in the workplace, for continuity purposes, if you lose access to the Internet, you've got to have a way to conduct transactions and keep citizen services moving — and so paper becomes the backup.”
Lynbrook’s plan, which was shared with GovTech, anticipates the loss of everything from credit card processing (answered by a reversion to checks and cash) and email (replaced by fax, phone calls and, in some cases, postal mail) to the downing of the key fob system at village headquarters (the alternative: reinstall manual locks).
Police would go back to handwriting parking tickets, while government procurements would need to take place via phone or in-person vendor meetings, Giordano said.
While a solar flare might knock out power in addition to Internet, the village expects its existing plans for restoring electricity — via generator — would go into effect, and so counts on having power available during a hypothetical Internet blackout.
BALANCING RESILIENCE AND PROTECTION
When considering how to ensure data remains accessible without Internet, assessments of the criticality, urgency and sensitivity of the data should guide agencies’ choices around what to print out, what to store as an offline copy on a computer and what kinds of password protections and access controls are needed, Reynolds said. Critical, urgent data needs to be handled in a way that allows for rapid restoration, while sensitive data needs privacy and security protections.
In her experience, county CFOs often print out backup copies of weeks' transactions, while other types of data might be stored on-premise by IT, such as in Excel databases. For the sake of privacy and security, it’s best practice for IT to save such on-site digital backups in one central location, rather than for employees to save copies on their desktops or email files to themselves.
To stay on top of this, counties should make sure to review their data retention policies and data asset inventories at least once a year, Reynolds said.
Reynolds urged agencies to test their plans, which can help them identify any gaps or needed adjustments. One opportunity is through her organization’s Cyber Simulation exercises, some of which include loss of Internet connectivity in the mock scenarios.
