Whatsapp service availability.

By Jorge García Carnicero

Whatsapp is the mobile application that has been adopted faster by most messaging users, becoming essential in a short period of time. Beyond the typical messaging functions, sending messages to groups of users has been established as the most common way to communicate between people, specifically when using the telematics platforms to coordinate activities of the real life.

Last February, 22nd, Whatsapp suffered one of the most important outages of its history, or at least it was the outage that affected a greatest number of users. A big amount of users didn't realize the service unavailability until about 7:30 pm., loosing their communications with their virtual environment without having an alternative way. But why?, because there are a lot of alternatives: SMS, Line, Telegram, Skipe and applications that are part of bigger systems, like Facebook Messenger or Google Hangouts. Because not all user though on the same alternative and two parts are required to establish a communication. The easiest solutions for most users was to make a telephone call.

Further than the panic and anxiety attacks suffered by some users, the analysis of the outage of Whatsapp from a business continuity perspective must be done taking into account that Whatsapp is becoming a real communications provider.

There are a lot of self-employed and SME that are using Whatsapp as a communications channel with their customers, making advertising with the green logo of the messaging company. It brings the company a modern branding  and a feeling of beeing close to the clients because the logo has positive emotional connotations: it’s associated with the contact with our most close environment in the mobile, our family and our friends. Without any doubt, it could be a very good decision from a neuromarketing strategies perspective. I wouldn't want to raise the debate of whether this use could be considered as legal, since in the Terms of Service Whatsapp expose clearly that it must be used only for non-commercial purposes. But, Can be Whatsapp be considered as a real corporate communication tool?

Little by little, step by step, people using Whatsapp for communications related with their professional activity are becoming more dependent of its service, but nobody ensures them that the service will be available in the terms they could need. Moreover, in their Terms of Service  Whatsapp avoid any kind of responsibility or damaged that can cause by their unavailability. In combination with the lax requirements defined by the regulatory organism (CNMC in Spain), makes the service should be considered unreliable in terms of business continuity.


In order that this could change, the service should be submitted, at least, to the same regulatory requirements that a telco operator. But it seems that is not going to happen in short terms, at least it's not included in the new Spanish telecommunications law  (ley general de telecomunicaciones) that is being processed during this months. So the recommendation that we have to make from a business continuity perspective is that Whatsapp should not be used as a corporate communication tool (and of course neither should be Line, Telegram, Skipe or whatever under the same circumstances). At least is has not to be used as a main communication channel and if used, their would be always an alternative way to establish the communication with the customer.

Last point of the analysis is the lack of agility of Whatsapp when communicating their problems. Although the services outage was at 7:30 pm the incident was recognized and communicated by the company at 21:16 by twitter in its account @wa_status. Could it be because Whatsapp founder and CEO was in Barcelona, in the MWC, this weekend?

Overview of SunGard CMS

As a continuation of my later post Business Continuity Management tools, I'm going to analyse deeply a tool which I've been with and I've some experience.  It's Continuity Management Solution Suite by SunGard Availability Services.

First of all is to speak about Sungard: is an Amercian company with headquarters in Wayne, Pennsylvania, born as a spin-of the IT department of a the oil company SUNOCO (Sun Oil Company), with a high presence in USA. The meaning of SunGard is Sun Guaranteed Access to Recovered Data, what shows the focus of their activity.

Sungard has four divisions: Availability Services, Financial Systems, K-12 Education and Public Sector, being the suit CMS  under SunGard AS division.

SunGard AS has its focus on Continuity, offering a huge portfolio that include workstation, recovery data centers, consultancy services, offices, mobile data centers and BC management software. In Spain the Authorized Represented of SunGard to BCM software is Sistemas Informáticos Abiertos (SIA) , offering also BC consultancy services and BC managed services.

Suite CMS by SunGard AS is on 7 modules, with the intention to include some additional module. All modules are presesented in the following picture:

Modules that are currently part of the suite are the following:

Los módulos que componen actualmente le suite son los siguiente:

• LDRPS : Living Disaster Recovery Planning System, is the core of the suite. Contain database that are the inventory of whole organization: employees, facilities, applications, technology, etc. Response procedures and plans are defined on this module.
• BIA Professional: In one of the four assessment modules. It's though to carry out impact analysis through web questionnaires that has to be responded by final users. Responses are stored in the different databases of LDRPS and are the source for plans automations. .
• Risk Assessment: Other assessment module, focused on risk. Identifys the main risks that affect to the different locations.
• Work Force Assessment: to evaluate the knowledge and preparedness of the employee.
• Vendor Assessment: to evaluate the preparedness of suppliers. 
• Incident Manager: It's a management board to manage crisis and help in the tracking of procedures defined in plans. It also provides alternative communications mechanisms, manage internal and external communications procedures, unique point of contact for coordination, etc..
• Notifind: completes the suite with communication massive communication features. Information stored in LDRPS is synchronized whit in databases located in operator Varolii in order to grant that communications are going to be carried out and any company resource are not going to be used.

BCM Tools

One of the most important decisions when establishing a Business Continuity program is the fact that if an automation tool is necessary or not, which involves the election of the tool if so. The use of any tool will condition both maintenance procedures and actions to be taken in case of activation of your business continuity plan.

There are different theories about the suitability of using automation tools to manage continuity, depending on the program maturity, the company size and the scope of the program. However, as we're going to see below, there are different types of tools and each type can be useful in different environments.

In general terms, there are two main types of business continuity tools:

• pre-event tools, are tools that can be use to grant the preparation in the organization. In this set of tools we can find a lot of options, because of the different types of activities related with it: risk analysis and management, impact analysis, compliance management, workforce assessment, suppliers management, documental management, and so on. Some examples of this kind of tools are: eBRP suite , myCOOP by COOP, CMS by SunGard, ShadowPlanner by ICM, RecoveryPlanner.com. All this tolls are specific continuity tools; Apart from this tools, there are others more close to the Information Security world, like RSA-Archer and others oriented to the document management, for example PCN by Ecija, although companies usually develop their own solutions to solve this functionality using SharePoint by Microsoft or Lotus Notes. Finally, there are some tools oriented to manage infrastructure technology continuity, likeRecoverGuard by ContinuitySoftware for data recovery, or CMDB modules, like the one from BMC Atrium
• post-event tools, are used when a disruption has occurred. In this way, we have two different types of tools: notification tools (Fact24, MIR3 Intelligent Notification, imodus or notifind, etc)and incident management tools (Incident Manager by SunGard and ESi). For this kind of tools is required a reliable, intuitive and quick access and has to be reached from any location.

In this picture can be seen the use of the different kind of tools, depending on the time frame in which we should use it, taking as a reference an event or disruption.

In Spain, due to the traditional approach to Business Continuity from Information Security perspective, the BC providers have developed tools around risk management, compliance management and impact analysis. In many cases, customers have developed their own BC tools, based in Sharepoint or Lotus, with limited scope and scalability.

A really effective tool from a BC point of view has to be a unique database, or synchronized with other sources. This way is the only that can assurance than the effort of managing the tool will not be greater than the effort of managing the whole program of BC.