SANS ISC: Doing the Right Thing - Internet Security | DShield

• SANS Site Network
  • Current Site
  • Internet Storm Center
  • Other SANS Sites Help
  • Graduate Degree Programs
  • Security Training
  • Security Certification
  • Security Awareness Training
  • Penetration Testing
  • Industrial Control Systems
  • Cyber Defense Foundations
  • DFIR
  • Software Security
  • Government OnSite Training

SANS ISC InfoSec Forums

Disclaimer: the author speaks from his experience both responding to national disasters with the American Red Cross post-9/11 pre-Katrina and as a volunteer Incident Handler.  His opinions are his own, and not those of the American Red Cross or SANS.

I have been both the “boots on the ground” and the “remote support” in a small number of national and international disasters.  I’ve been in your shoes: wanting to do something to help.  I’d like to share a bit of my experience to help you help others (and possibly yourself.)

First Rule of Disaster Response

The first rule of responding to a disaster situation is: “Don’t become a victim.”  You’re not helping the situation if you rent a truck, fill it full of donations and drive into a scene that isn’t ready to receive you.  You’ll likely run out of fuel, have no shelter, and may have to eat those canned goods that you were hoping to distribute.  Not-becoming-a-victim also applies to being aware and wary of donation-scams that will come at you from a number of channels (see other recent diary entries for current examples.)

There’s a second rule of: “Don’t try to profit from a disaster,” but the people who need to hear that aren’t reading this.

Giving 100%

Anyone that promises to pass on 100% of your donation to the “Victims of X-event” is not telling you the truth.  Either they’re consciously lying to you, or they don’t understand what they’re doing.  In either case, it’s not a good idea to give them your money.

If you donate via SMS, the telco carrier takes their cut.  If you send by PayPal, they have their fees.  If you send a check via Parcel Post, the US Postal Service charges postage.  I’m not saying that any of these organizations are greedy or guilty of violating the 2nd rule of disaster response.  I’m saying that overhead will always be present, and when an organization responsibly reports their operations overhead, that’s a good sign.

Why Earmarking is Bad

When you make a donation to an organization, resist the urge to check that “apply these funds to X-event” box.  The organization receiving your money has already invested many thousands of dollars prepping for the next disaster, and those batteries, and cell phones, bottles of water, blankets, etc. that are now being distributed wasn’t paid for out of the X-event fund.  After X-event is over, they’re going to need to replenish the supplies and gear to prepare for the next disaster.

Forcing the organization to spend money on a given operation leads to irrational spending and waste.

What’s the Good News?

I certainly don’t want to scare anyone away from reaching out to help, in fact I’d like to encourage you to donate if you can, and volunteer if you can.  There is a lot that dedicated individuals and small groups can accomplish when they're organized.

Who do You Trust?

When donating in response to a disaster in another country, it’s best to stick with well-established organizations and ideally those that already have an operating presence in the stricken area.  If you don’t know where to start I’d like to humbly suggest one of the following:
 

• CARE: http://www.care.org/
• International Red Cross:  http://www.icrc.org/
• Medecins Sans Frontieres/Doctors Without Borders: http://doctorswithoutborders.org/
   

Kevin Liston
kliston@isc.sans.org