One key way courts can prepare, experts say, are tabletop exercises, which are discussion-based sessions — often held in classrooms — with a goal of discussing team members' roles and responses during an emergency. Not holding these exercises can potentially have major consequences. Indeed, a court failing to prepare for an emergency may shake public confidence, said Justin Mammen, emergency response and security services manager for Florida’s Orange County Superior Court, who spoke during the recent National Center for State Courts' (NCSC) Court Technology Conference.
“Historically, especially in the past few years, confidence in the justice system has kind of decreased ... . And, unfortunately, if we can’t get our act together after a disaster, that confidence continues to decline,” Mammen said.
Threats can mean wildfires burning up parts of the buildings. Earthquake damage exposing asbestos. Hackers shutting down electricity or stealing sensitive data amid a high-profile hearing.
“Courts are a very juicy target when it comes to cyber criminals,” said Mammen. “We hold a lot of sensitive data; we are custodians of justice, we carry a lot of things, we have closed, sealed files. Those are the kinds of things hackers want to get into.”
So what’s a court to do?
Being resilient means not only preparing continuity of operation and response and recovery plans, but also practicing them. Training response activities will help courts discover gaps in their plans and make sure they’re ready to jump into action if and when the time comes.
Mammen’s court, for example, had been planning how to relocate should the courthouse become inaccessible. It put that emergency plan to the test with a physical run-through that saw staff set up a courtroom on a local university campus and conduct a day of mock cases. One revelation? They were going to need to find more bathrooms. The incident also inspired the court to create virtual courtrooms — something that proved handy when COVID-19 hit.
But not everyone must — or should — jump into such a complex, time-consuming undertaking.
Tabletop exercises are a simpler, lower-cost way to walk through emergency plans, find gaps and pin down details. Tabletops can mean as little as getting relevant stakeholders together in a room, where a facilitator presents a specific emergency scenario and everyone talks through what their roles would be and how they’d respond as a situation develops.
“Oftentimes we make these grand statements: ‘Well, we’ll just let everybody do this’ or, ‘We’re going to move all criminal operations to this courthouse.’ But how easily and realistically can that actually be done? That’s where exercises come in,” Mammen said.
Tabletop exercises should focus on clear objectives. The Federal Emergency Management Agency's (FEMA) Threat Hazard Identification and Risk Assessment can help courthouses identify risks relevant to them and hypothetical worst-case scenarios.
During tabletops, facilitators can also present mock complications or updates in the situation — called injects — that prompt attendees to consider how they’d respond, like trending social media posts that falsely claim litigants’ data was leaked.
But it can be hard to introduce tabletops in courthouses. When trying to get a tabletop exercise off the ground and get leadership buy-in, two things can help. One: basing tabletop scenarios on things that happened to other courthouses, so no one can dismiss the threats as unrealistic. Two, starting small.
When a court in Arizona tried to jump straight to a tabletop exercise of a cyber scenario, “they couldn't get past the first page, because they had so many questions,” said Jared Nishimoto, court information systems coordinator for Flagstaff, Ariz., during the presentation.
Rather than tackle a complex cybersecurity scenario in a multihour session, courts should start with a scenario focused on a straightforward threat and very narrow objective. Think a 30-minute session just focused on figuring out where to relocate if there’s a fire in the courthouse, Nishimoto said. Then they can move on to practicing other kinds of challenges.
As for the practical details of these exercises, Mammen said he finds two to four hours to be the sweet spot for exercises, although smaller ones can be crafted to meet needs, including working around judges' busy schedules. If possible, holding events in person at a remote location can keep folks more focused.
Courthouses looking to begin tabletops also don’t need to start from scratch.
When designing emergency plans, they can customize existing templates, such as the NCSC’s continuity of operations planning guide and other resources. And for help running exercises or extracting conclusions, courts can consider inviting local subject matter experts like fusion center analysts to sit in and lend advice. Local or state emergency management agencies may also be able to assist with designing exercises. Plus, courts can find tabletop exercise tools from CISA and apply to FEMA for free assistance.
