Remembering 9/11: IT Lessons Learned from the Attack and Its Aftermath

We all remember where we were and what we were doing on the morning of Sept. 11, 2001. It is as galvanized in our consciousness as our parents’ and our grandparents’ memories of Dec. 7, 1941.

These memories are called “flashbulb memories,” a term coined in the 1970s, according to U.S. News and World Report, as a metaphor for capturing an entire scene in one moment.

My flashbulb memory: On the morning of Sept. 11, 2001, I was in my office at the Florida Department of Corrections, packing my briefcase to prepare for my “side hustle” as director of the Office of Information Security. I had created the office in February 2001, as part of the old State Technology Office, or STO. The Legislature had just given us authority to write rules, so I had called a meeting of all the agency information security officers (ISOs) for that morning in a conference room at the state data center.

As I finished packing my documents, one of my employees rushed, breathless, into my office. “Turn on your TV!” he yelled. I did so, and as many other Americans did, I watched the second airplane fly into the South Tower. I closed my briefcase and drove to the Shared Resource Center.

When I arrived, news of the terrible acts had begun to filter in to the meeting participants. I announced there would be no rule-writing today. “I am declaring a cyber emergency,” I announced, setting a policy that, hopefully, is still observed in Florida: Any act of conventional terrorism will be either preceded by or concurrent with an act of cyber terrorism.

“What is a cyber emergency?” one of the ISOs asked.

“I don’t know,” I confessed. “We will make it up as we go along.”

We put all the agency IT shops on high alert. We especially hardened outside exposure to the Internet through such portals as instant messaging, which represented a security threat. We told them what to be looking for and what their due diligence would require.

In the category of “forgiveness versus permission,” I chose forgiveness. A couple of days after my orders, Gov. Jeb Bush wanted to know why instant messaging was down. It was ordered shut down due to security concerns, an aide responded. “By whom?” the governor demanded to know. “Scooter,” the aide replied. “Scooter” was an old nickname given to me by Jeb in the early 1980s. “Oh, OK,” the governor said as he headed back to his office.

Sure enough, a week to the hour after the second plane went into the South Tower, the Nimda virus struck. A variant of the Code Red virus, Nimda was an attempt to inflict cyber damage onto a nation already reeling from the attacks. Many systems around the world were impacted by Nimda.

Fortunately, few systems in state government in Florida were affected. Why? Because we had been expecting it, or something like it; had drawn up contingency plans; and were prepared to act.

Those plans also included referring to our still-current Y2K plans. Fortunately, we were only less than two years removed from intense preparations for the millennium rollover.

Those Y2K plans also helped save Merrill Lynch.

On the morning of 9/11, Merrill Lynch’s primary data center was housed in the World Financial Center in lower Manhattan. Those are the buildings that surrounded the World Trade Center (WTC). Jerry Curtis was a senior technology manager for Merrill Lynch. While the WTC was obviously uninhabitable following the attacks, so were the buildings of the World Financial Center. Jerry’s assignment was monumental: restore Merrill Lynch’s trading capacity as soon as possible. Money was no object. Jerry had forgiveness — decision-making authority.

Jerry pulled out his Y2K plans as a reference. People had to travel in a special bus to the site, dressed in a “moon suit” to guard against toxic debris and waste. They had to pull drives from servers and could only take away what they could carry on their laps. They also could not add to the waste and had to bring out exactly what they took in, along with the drives.

Meanwhile, the federal government was conscripting entire shipments of computers destined for customers in the tri-state area, to be used by government disaster officials. Recall that the Department of Homeland Security did not exist yet. Jerry sent an urgent request up the chain to the CEO of Merrill Lynch to please call Michael Dell personally. Dell responded by dedicating an entire 24-hour production cycle to building laptop and desktop computers for Merrill Lynch personnel.

Those employees were housed as far away as Pennsylvania and Connecticut — wherever Merrill Lynch had space, or could find space. Provisioning those computers also took a superhuman effort.

In order to circumvent the feds’ confiscation of computer equipment, Curtis arranged for the hiring of wildcat truckers — independent contractors, paid in cash, and without manifests the feds could appropriate in order to seize the computers. Those truckers also were paid to undertake on-the-job training and helped deploy and provision the same computers they just delivered!

Further compounding Merrill Lynch’s recovery efforts was the location of its disaster recovery data center. It was located less than two blocks away from its primary data center, also in lower Manhattan. It, too, was unusable. Emergency data center space had to be found, and quickly.

Remarkably and miraculously, a week following the worst terrorist attack in American history, Merrill Lynch was up and operational and trading.

Jerry’s LinkedIn profile includes the following item: “Led post-9/11 recovery by building 5,000 new desktops and 2,000 new laptops in two days using truck drivers. Accomplished by deploying a new software management infrastructure that allowed department managers to specify the operating systems and software needed as they relocated from lower NYC.“

Jerry Curtis is now vice president of technology for DXC Technology in Ashburn, Va. As he did with Merrill Lynch, Jerry commutes from his home in Lakeland, Fla.

Scott McPherson is the former chief information officer of the Florida House of Representatives, and has also held public-sector IT leadership roles including with the Florida Department of Corrections and the State Technology Office. McPherson is a senior fellow at the Center for Digital Government, which is part of e.Republic, Industry Insider — Florida's parent company.