The terrorist attacks in Mumbai, India, at the end of November represented an unspeakable human tragedy. Even more tragic is the fact that though the attacks began at 9:30 p.m., it was not until 7 a.m. the following morning — more than nine hours later — that commandoes from India’s National Security Guards (NSG) were able to reach the sites. What lessons in logistics does this experience offer? How can India — and, indeed, any country that faces terrorist threats — use the principles of logistics to come up with defense systems that can respond faster to attacks against their citizens? India Knowledge at Wharton discussed this question with Morris Cohen, a professor of operations and information management at Wharton and chairman of MCA Solutions, a logistics software firm.

An edited version of the transcript appears below:

India Knowledge at Wharton: Could we start by talking about your research in logistics and how it relates to the situation that the security forces in India faced after the terrorist attacks in Bombay?

Morris Cohen: Sure. My research in logistics, broadly speaking, is in the area of supply chain planning. More specifically, I have focused over the last 10 years or so in the area of service supply chains. That area deals with the way organizations manage resources that are required to meet demand for service that is usually difficult, if not impossible to predict, and which has mission critical, possibly catastrophic, consequences if there are delays in matching supply with demand. The typical area we focus on in this research is what’s called the “after market” in providing service parts and repair capacities to support the availability of mission critical products. This includes things like the military using their weapons systems in military engagements, or a company like Intel using semiconductor equipment in order to produce chips in a fabrication line.

What all these situations have in common is the fact that the resource or product has very high value, but only when it’s available and is being used. All products, no matter how well-designed and built they are, are subject to failure in the field. Random events make them unavailable, and during that time, of course, they don’t generate value. The focus of the service supply chain is to enable more value to be created more efficiently — lower investment in resources and at a lower cost. It’s all about positioning resources and managing their flow to support the availability of mission critical products.

India Knowledge at Wharton: How would that relate to a situation where the demand is a need for security forces in response to a terrorist attack? How would you frame that kind of a problem?

Cohen: There are very strong parallels here. First, we’re dealing with what we call in the service supply chain business, “intermittent demand.” That’s demand that occurs randomly or rarely. Products may fail, and the mean time between such product failures is measured in years or decades. Looking at historical consumption or occurrence of events is a very poor indicator of when and where a failure event will occur, such that resources are needed. In this case, the event is the terrorist attack. It is like all these service events, if we can call it that, without taking away the horrific nature of it. But it’s a random, unpredicted event that occurred at a time and place that we didn’t know very well in advance. Resources need to be provided to that place as quickly as possible. The key metric in managing service supply chains is response time: How long does it take to get a resource that’s needed to repair the situation? In the case of the terrorist attack, the resources were the commandos, the military forces and all their equipment.

It’s no good if the equipment is 150 miles away, which it was in this case. After the Mumbai attacks, according to media reports, it took nine or ten hours for the commandoes to show up. Just to give you an illustration from the commercial side, Intel has a $3 billion-plus capital investment in making chips. The major cost — close to 60% — in producing these chips is the semiconductor equipment. Intel tells its suppliers of equipment that, if one of your products should fail, you have 15 minutes to be there with the required part and a customer engineer who has the knowledge and capability to begin the repair. The reason is that they estimate that with that capital intensive situation, it costs them almost $100,000 an hour if a line is down.

Consider another example. When the U.S. Navy wants an aircraft carrier to take off for the Gulf, and the F-22 or the F-18, whatever the aircraft is, can’t take off because the radar isn’t working, the cost of not being able to complete the mission could be catastrophic. You could lose lives, you could lose the battle. For the want of a nail, we could lose the war. This response time is measured in minutes, and sometimes in seconds. When life is involved, or where there are potentially catastrophic consequences, we have to bring resources to where they’re needed.

India Knowledge at Wharton: How could that have been done in a situation like the one that Bombay faced?

Cohen: Obviously, it is a challenging problem. The analogy that I like to give is that of the fire station. Fire stations are strategically located in every major city. An efficiency expert could ask, “What’s the utilization rate of the fire station, either the personnel or the equipment?” It’s much lower than 50%. What do the firemen do most of the time? They polish the engine, they play checkers, they watch TV. Nobody expects them to be putting out fires 10 hours a day. You might argue that they’re not very productive. But when a fire occurs, they have to get there rapidly. That’s their job.

In this context, the key challenge is that the resources required to mitigate such events are very expensive. A radar system for an F-18 on an aircraft carrier is a multimillion dollar part. The piece of equipment in an Intel fabrication line that goes down is a multimillion dollar piece of equipment. It may go down for a 10-cent part, but that doesn’t matter; the cost is very high. You have to have very expensive resources positioned in advance — and that’s the key word. You could ask, “What logistic system could deliver a part to the Intel line within 15 minutes?” I always say, “Unless you’re in Star Trek, where you can beam something up, there is no logistic system that could deliver something from point A to point B in 15 minutes, unless it’s already there.”

This means you have to prepare and invest in advance in resources without knowing exactly when and where they’re going to be used. It seems to me this is exactly the situation in Mumbai. There were resources that could have addressed the problem, but they weren’t in the right place, they weren’t in the right quantity, and we didn’t have the infrastructure, the communication systems, or the transportation systems to get them where they were needed.

Now, the other extreme is you could have an armed guard beside every citizen. That’s obviously impossible. One of the companies I work with in the aerospace and defense industry, Boeing, has the same problem. If we had to base our investment and parts to support the weapon systems in the field on the basis of some kind of forecast, and we rounded up the forecasts, we’d be out of business. The cost would be prohibitive. You cannot have a copy of every part and of every machine beside every place where it might be needed. And so, you have a fundamental tradeoff between risk and reward.

The way this problem is solved is exactly the way we solve any risk management problem: We have a budget, and we have a standard. It could be a response-time standard, it could be an availability or uptime standard, and we try to figure out the best way to position resources in advance. As a result, when the event occurs and we’re in the world of what we call “event management” instead of “planning,” we can respond adequately and quickly. From my experience working in this area, I would argue that 90% of the ability of any supply chain to respond to such events is based upon decisions that are made prior to the event. If you have to react after the event, it’s too late.

India Knowledge at Wharton: If the Prime Minister and President of India asked you for suggestions on designing a system that would respond to such threats, what would your advise be?

Cohen: As I said, this is a complicated problem. It involves positioning resources and deploying them. Usually these are expensive resources — and when they are positioned, it must be with the understanding that they’ll be sitting there, for the most part, unused. There’s a limit to what any organization, be it a company or a government, is willing to invest in that. There should be a budget. The first question, I would say, is how much of a budget is India willing to invest in providing resources to help insure against these types of events. I use the word insure very advisedly. This is like purchasing an insurance policy.

The second question — and this is not an easy one to answer — is what’s the service standard? What should have been the expectation, the planning standard? Should we have designed a system so that we could respond in 15 minutes, 30 minutes, two hours, four hours? It makes an enormous difference. You can imagine the faster you want to be there, the more expensive it’s going to be. This is an environment where costs go up in a highly non-linear fashion. If you wanted to be there instantaneously, you could argue that you would need an infinite amount of resources — because we cannot eliminate the risk.

If you’re willing to wait an hour, versus half an hour, you might save perhaps 50% of the cost. How does one answer that question? That’s a socio-political issue. What quality of safety, of insurance, does the government feel it has to provide its citizens in a situation like this?

India Knowledge at Wharton: If you were to consider the governments of countries where terrorist attacks are frequent, how do they resolve this issue?

Cohen: Well, one way or another, they have to answer those two questions: What resources are they willing to invest, and what should be the service standard? The next question is, how do we optimize? How do we get the best quality of service for that budget? How do we — to put it perhaps in the wrong euphemism — get the best bang for the buck, as its sometimes called. That is probably not appropriate here.

In the U.S., Hurricane Katrina offers a perfect example. It was a terrible disaster. People in New Orleans waited days for resources to come to them. This was a major political issue. And yet, compare the government’s response to that of Wal-Mart. Wal-Mart had analyzed hurricanes in the past and the company came up with some predictions. It discovered that one of the products that has the highest demand immediately after a hurricane is Pop-Tarts. It’s frozen food; you can put it in your toaster and you immediately have something to eat. They also stocked batteries, flashlights and other products. When Wal-Mart saw the forecast that a hurricane was coming, they positioned high quantities of these resources. Insurance companies did the same thing. They knew they would need underwriters and adjusters, so they positioned them just out of harms way so that they could respond quickly.

The government, on the other hand, was not prepared. It took the military a long time to respond. All kinds of things can be done. There’s a process by which you respond. You want to have the most efficient and effective process. I don’t in any way reduce the value of training the right people. The firemen drill. They know how to respond. When the bell rings, how long does it take them to get on the engine and go down the street? Thirty seconds? If you haven’t trained for that, there’s no way you can do that. On the other hand, if you didn’t have the engine there, gassed up and ready to go, it wouldn’t have done you any good. So this is a complicated problem. It involves trade-offs between risk and reward. It’s hard for any company, let alone a government, to quantify the cost of an extra minute of delay. Could a life have been saved? How much should we have invested potentially to avoid that?

India Knowledge at Wharton: One final question. What is the most significant lesson that people should learn from the terrorist attacks in India and the response to it?

Cohen: I would give it in one word: planning. One has to plan for these events. That doesn’t mean you can predict when and where they will occur, but you have to be able to understand the probability of how they will occur. You have to be able to take that estimate of risk, quantify it and make firm commitments about what resources you want to invest and what service standards you want to achieve. You must recognize that in order to solve this problem effectively, to get the most value for your investment — or for society’s investment, in this case — some tough trade-offs are required. But without appropriate planning, it’s difficult to react effectively. We saw in Mumbai the tragedy of reacting without having gone through the process of planning in advance.

By doing all this, you will not prevent the terrorist attack — that’s a topic for another day, perhaps. But it will mitigate the cost, the impact, when it does happen.