Incident response lessons from the Texas flash flood

During the overnight hours of Saturday night and Sunday morning May 23-24, heavy rain in the Texas Hill Country triggered a flash flood of near-Biblical proportions in Wimberley and San Marcos. This is the story of a disaster response program executed exceptionally well.

Flooding rains are not uncommon in Central Texas. The region has long been known as "Flash Flood Alley" due to its hilly terrain, shallow soils, and proximity to the moisture-laden Gulf of Mexico. When rain falls, it essentially has two options: soak into the soil, or flow downhill; the shallow and rocky soils of the Hill Country limit the former, so even a moderate rain causes runoff.

The weekend of Memorial Day 2015, however, was something else entirely. Over a period of a few hours, between nine and 12.5 inches of rain fell over a wide range of the Hill Country - much of which fell within the watersheds of the Blanco and San Marcos rivers. A foot of rainfall - a third of a typical year's total - inundated the region in just a few hours, and had to go somewhere.

[ ALSO ON CSO: Why disaster recovery planning can save lives ]

The result was a catastrophic flash flood. The Blanco River rose 17 feet in a half hour, and 33 feet in a three-hour span, peaking far higher than had ever been recorded or even thought possible. Towering cypress trees that had survived six centuries of drought and flood were no match for this monstrous storm. In the lead photo to this story, massive cypress trees have been stripped of bark and branches 30 feet above the normally-placid river's surface.

Ultimately, a 40-foot wall of water rushed downstream, scouring away everything in its path: trees, vehicles, homes, bridges, and unfortunately, people.

Shortly afterward I wrote of the amazing resilience embedded in Texas culture. Texas has a long history of neighbors helping neighbors, and that culture showed itself after this disaster. From the many volunteers searching for the missing, to local businesses offering to replace vital necessities, to an impromptu clearinghouse to lend and borrow heavy equipment, watching the community set about the business of recovering has been an inspiration.

Individual resilience is not enough in the face of a disaster of this magnitude though. Rebuilding hundreds of homes, roadway infrastructure, communications, and the other essentials of modern life requires a coordinated effort. Whether cyber or physical, some lessons apply in any disaster.

Lesson 1: Preparedness

In the midst of a crisis an organization falls back on its planning and preparedness. When an incident occurs, it is too late to put together a response plan. Flash floods are a known threat in Central Texas, and the region has several initiatives to address this threat.

The City of Austin Flood Early Warning System reports the current state of over 1,000 "low water crossings" - often little more than a roadway with a culvert to allow a creek to pass beneath; during heavy rain, these crossings will frequently be temporarily impassable.

The counties have spent years building awareness: 18 to 24 inches of moving water is enough to sweep most vehicles off the road. The saying "Turn Around, Don't Drown" is ingrained in the minds of residents.

Ten counties in the greater Austin area participate in a Regional Notification System, whereby residents and interested parties can register their landlines and cell phones to receive notification of threats to life or property.

Hays County has a long-standing volunteer Community Emergency Response Team trained to respond to wildfires, tornadoes, car wrecks, and flash floods.

Hays County has set up as a central location for authoritative information during an emergency.

All of these steps required time to plan and to implement - and all were in place long before this crisis arose.

Lesson 2: Damage control

During an incident, damage control is the first rule. In a cyber event, you may be able to isolate the compromised environment to prevent further damage. You don't contain 10 billion gallons of rushing water though, so you do the next best thing: get out of the way. 

Amazingly, in a flash flood that destroyed 320 homes during the middle of the night, only 12 individuals were swept away. One was rescued the following morning and is alive today. Nine have been recovered deceased. Tragically, the two remaining unaccounted for are a 6-year-old boy, and the 4-year-old daughter of the rescued survivor.

In this event, "damage control" took a multi-pronged approach. The National Weather Service had issued a flash flood watch early Saturday, but the situation did not become critical until around midnight Saturday night/Sunday morning. The NWS archive records the increasingly dire warnings as the reality of this event unfolded. This leads to lesson three...

1 2 Page 1
Page 1 of 2
Make your voice heard. Share your experience in CSO's Security Priorities Study.