As the threat of terrorist attack looms ever closer over London, Lucy Hickman examines what City law firms are doing to prepare themselves for disaster recovery should the worst happen

According to Alex Bomberg, managing director of International Intelligence, a Cheltenham-based security firm, it is not a question of if London will be hit by a terror attack, but when.

‘The likelihood of attack in London is extremely high – even more so than at the height of the IRA terror threat. And the strike will be bigger than anything the IRA ever did. People such as those responsible for the 11 September [2001] attacks just want to kill as many people as possible.’

Phil Page, City firm Herbert Smith’s head of security, says 11 September helped focus people’s minds more on security and disaster recovery.

‘Our policy has changed since 11 September. It focused the minds more of people higher up in the organisation. It got security and disaster recovery on people’s agendas.’

Mike Stephenson, head of administration at City firm Macfarlanes, agrees. He says: ‘People are more conscious of their personal security and more aware of their surroundings. That carries into work. We had plans in place before 11 September, but after that we did look at them in more detail, although we didn’t change things significantly.’

The facilities manager of a City law firm, which asked not to be identified for security reasons, says that although the threat of attack is taken seriously – particularly since his firm is based close to some potential targets.

‘I was at the Old Bailey in 1972 when the first IRA bomb went off. For years you live with the fear every time you passed a car that it might be booby-trapped. You get used to it. You either stay at home and become a nervous wreck or become stoic and carry on.’

Mr Bomberg, whose firm specialises in advising law firms on security and counter-terrorism matters, says most law firms – and London’s emergency services – simply could not cope should the worst happen.

‘Most of the firms we have come across are ill-prepared. Basic stuff like who is in the building is not known. Many are reluctant to have people signing in and out – they think it is too much of a pain – but one of the lessons that should have been learnt from 11 September is the need to be able to identify the people who might be involved.

‘London isn’t ready for any sort of terrorist attack. If you had something along the lines of what happened in Madrid here, London wouldn’t be able to cope.

‘London transport isn’t great at the best of times and you’d have the emergency services trying to get in and people trying to get out. And if it were a biological or chemical attack, martial law might be imposed to stop contamination spreading. People wouldn’t be allowed to leave until they had been decontaminated, but it would be very difficult to keep everyone in.’

The unnamed City law firm spokesman says that however comprehensive a firm’s disaster-recovery policy is, it is impossible to cater for every possibility, although at least a new ice age, as envisioned in the film ‘The Day After Tomorrow’, does not appear to be one firms have to worry about much.

‘We have a disaster-recovery site with 100 work stations that we are guaranteed access to within three hours. It is in north London – near enough to get there quickly but hopefully far enough from the City to escape the effects of a bomb blast there. All our computer systems are backed up every day and our phones would be diverted.

‘It is difficult to know how to counter the threat of biological or chemical attack – you can’t provide equipment for all the staff to cover every scenario. We would have to deal with it at the time and concentrate on evacuating the building as quickly as possible.’

Freshfields Bruckhaus Deringer has taken some steps to protect its staff in the event of chemical or biological attack. A spokesman says: ‘We have modified our fresh-air intake plant to allow an emergency shutdown of that plant should we receive sufficient warning of an external chemical attack. We are researching other options and safeguards.’

Mr Bomberg says that law firms themselves may not be actual targets – unless they are carrying out potentially sensitive work in the Middle East – but being based in the City may mean they could be caught in the fall out.

‘City law firms are vulnerable purely due to their location. There are a number of potential targets in that area: strategic targets such as railway stations and law courts as well as political and financial targets such as the Stock Exchange.’

A spokesman for City firm CMS Cameron McKenna says: ‘The threats we envisage would be those in common with any business operating in London at this time, from fire and theft to cyber-attacks or physical attacks on the City. We keep in touch with the City of London police on the threat level.

‘Our disaster-recovery policy covers plans for various possible scenarios, ranging from physical loss of buildings, IT systems and services, to plans in the event of cyber-attacks on our IT systems.’

The Freshfields spokesman says: ‘Our London office is no more or less vulnerable than other buildings or law firms in central London and relatively close to the Royal Courts of Justice and the Central Criminal Court.

‘We take the current climate seriously and have instituted appropriate measures and safeguards. We have regular drilled “safe haven” and fire evacuations, and regularly test our alarms and procedures. There is 24-hour, on-site security presence as well as a premises-access control system and extensive closed-circuit television (CCTV) coverage.’

He adds: ‘The firm has a business-continuity programme to ensure that in the event of a disaster, our partners and staff are accounted for and our clients receive continuity of support.

‘The programme is designed to help our firm survive a number of scenarios including explosion, fire, flood and failure of IT systems. And it sets out all of the key actions to be taken in responding to and recovering from a crisis, and is designed to ensure that the firm returns to normal operations at its premises or alternative premises as quickly as possible.’

A spokesman for City firm Lovells explains: ‘We have a detailed document itemising the activities to be undertaken by a core team to restore the firm’s business within 48 hours. This is precisely detailed in sequential order for differing scenarios, from disruption to one of the firm’s buildings with no casualties to devastation of all buildings with multiple injuries and fatalities.’

Mr Bomberg says that basic security measures such as CCTV cameras in offices, underground car parks and requiring visitors and staff to sign in and out of buildings could help deter terrorists.

‘Most terrorists will do a reconnaissance before an attack. If someone on reconnaissance enters a building and gets challenged immediately, the chances are they won’t hit that building.’

He says that although most law firms regularly back up their computer systems – as all the firms questioned confirm – there are a number of other steps that should be included by firms in even a basic disaster-recovery policy.

‘Everyone must understand the evacuation procedure, which might be different depending on the type of attack. First aid must be prominent. If firms share a building, they should liaise closely with the other tenants to make sure they are singing from the same song sheet.’

Herbert Smith shares a building with two other tenants. Mr Page says: ‘We have to work closely with the landlord and the other two tenants. We would like to think we have our house in order, we hope they have too.’

Mr Bomberg adds that firms should give priority to getting the firm set up with work stations in a new location as fast as possible because, as he puts it, ‘we all have to make money – that’s what we are in business for’.

Lucy Hickman is a freelance journalist