Y2K bug expert addresses BOMA/NY luncheon.

Major airlines have said they won't fly on New Year's Eve, 1999 due to the possibility of a shutdown by the Y2K computer "millennium bug." In mid-October, President Clinton signed into law S.2392 - the Year 2000 Information and Readiness Disclosure Act. And the price-tag for testing and compliance in the U.S. alone is estimated in the billions, with still more than 400 days left.

As the widespread nature of the Y2K problem has ripped away the once-protective layer of the "we'll revert to manual systems" school of thinking, tough questions have emerged: How reliable are the tests? Is compliance certification enough? Even if our building systems are compliant, will there be sufficient power and telecommunications support on December 31, 1999? And the big question on everyone's lips, will there be a meltdown?

Susan A. Jarrett, a leading Y2K expert and the individual who for more than two years has headed up the debugging and demystifying of the millennium problem for Morgan Stanley's global facilities, tackled these questions at the BOMA/NY October luncheon, walking the more than 350 building management professionals through the realities and implications of Y2K.

There are 39 languages (at minimum) used for the embedded chips that are at the core of the problem, and embedded systems make every computer system a customer site - there are no broad stroke solutions," advised the Morgan Stanley vice president. "Each system and piece of equipment must be tested individually," she said, pointing to the fact that in many cases, manufacturers did not track where the chips that they used came from and are therefore unable to verify compliance.

Further, you must look at all equipment and systems in the same light. For example, elevators typically do not have date sensitivity, but they "become volatile when you hook them up to the fire alarm system because of the embedded chip in the alarm devices."

She also cautioned that "sometimes testing is not an option - you have to wait until the equipment is updated or replaced." And she advised strongly against relying on running systems manually, as it creates even more problems and may require bringing extra personnel on board - if it's even possible to identify who you need to bring in.

Security is a gray area, Jarrett said, and difficult to evaluate as there "has not been as good a response from vendors," usually revolving around compliance statements. And while the general press has warned about a power scenario where even the most compliant, state-of-the-art systems would be rendered virtually useless because of a lack of energy, Jarrett told the building management group that Con Edison has been doing the testing.

She added, however, that they have been fairly low-key about promoting their testing activities, and called for BOMA/NY to supply something in much need - strength through partnership. "One of the problems is the compartmentalizing - each company or entity is testing on its own when it could be sharing information and benefitting, perhaps even saving time and money.

Morgan Stanley is part of a consortium of similar firms pooling their Y2K knowledge, and Jarrett affirmed that "if competitors as fierce as those in the merchant banking business could cooperate, then an organization such as BOMA/NY, with its cooperative mechanisms already in place, could be a major contributor."

She called for BOMA/NY to exercise its leverage by sharing information, as well as the experience gained by sharing test plans and results, and to collect and disseminate information. The S.2392 law, she added, promotes greater sharing of experiences and solutions. It has protections for exposure related to information exchange, but does not affect liability arising from Y2K failures of systems or devices, and does not cover statements to consumers in marketing a product normally sold for personal use.

While many firms have their own testing protocols in place, Jarrett strongly advised: always do testing on site; power down in the new millennium because "failures sometimes happen in that time frame; create an alarm condition; and when restoring the power, examine what the data did and did not show.

"Inventory your systems in-house, "Jarrett added, based on her testing team's experience with manufacturers who may not supply accurate information, and who may not have done in-depth testing. Products or services may have changed. "Even with a compliance statement from a manufacture in hand," she said, "testing has failed."

"Testing is not always simple or conclusive," Jarrett continued and advised:

* Review the plan and configuration at length with the tester; making sure technicians are hardware/software conversant, preferably with Y2K test experience, and armed with the required passwords;

* Make available a window of time for the testing and/or are available on stand-by;

* Be aware that embedded and integrated systems create customized products which may be built for only one site, and therefore you must test at every installation, on every upgrade and with every technical visit. "We are discovering that the embedded systems issue deepens with customization," Jarrett said.

Be aware, she cautioned, that manufacturers do not have all the answers on both component readiness or test results. "To mitigate your risk, you must plan for contingencies, understand and reduce your exposure, maintaining compliance after testing," jarrett said. "And definitely, let your tenants know you have a plan in place and are doing the testing. This is one case where no news is bad news."