Browsed by
Category: Resilience

The Wave (2015) – an emergency planners review

The Wave (2015) – an emergency planners review

Reading Time: 2 minutes

Inspired partly by Parasite director Bong Joon Ho’s acceptance speech at the 2020 Golden Globes I decided to watch The Wave, a 2005 Norweigian film based on the Tajfjord rockslide in April 1934, which resulted in a 40m tsunami killing 40 people.

Before I even had to contend with subtitles, the first challenge was finding a way to watch it. At the time of writing, it’s not available via Netflix UK or Amazon Prime Video, but I tracked it down and watched on YouTube.

Like lots of disaster movies, and many real-life disasters, the warning signs were there from the outset.

The context is clear. It will happen again, but scientists don’t know when.

Well reader, I don’t think it’s too much of a spoiler that I confidently predict something decidedly bad will happen in the next 90 minutes.

Cut to the present day.

Kristian is working his last day as a geologist, relocating his family to take a job with the dark side of the oil industry. Groundwater sensors embedded across the mountain indicate something is amiss but it’s dismissed by his colleagues. It takes time for Kristian to convince his colleagues that ‘something is up’, he abandons his children and they set off to find their hotel manager mother. A good rule of thumb based on most disaster movies and all horror movies that I’ve seen: do not split up.

Anyway, by the time the data is telling a compelling enough story, the geologists have slightly 10 minutes to save the town. Even in a town of just 250 people, arranging evacuation in 10 minutes is a tall order.There are signs that the situation has been planned for. The alarm is (eventually) sounded, people take to their cars, pausing to pack personal possessions. There aren’t many routes out of the town, but it’s all relatively well ordered.

Bucking the Hollywood trend, the film shows no scenes of looting. This supports a growing evidence base that people affected by disaster are typically pro-social. I found this really refreshing.

After the tsunami arrives focus shifts to Kristian’s attempt to find his family. He’s reunited with his daughter fairly quickly, but he has to mount a one-man rescue mission to find his wife and son. I don’t want to spoil the dramatic tension in the latter part of the film, but suffice to say that one scene, in particular, is reminiscent of Titanic.

Overall I really enjoyed The Wave. There were still some great action sequences but it was a different, slightly calmer take on disaster.

 

Get real about grab bags

Get real about grab bags

Reading Time: 4 minutes

In the week that has seen #GrabBags trending on Twitter and a BBC news article on the same topic ranked at number 5, there has never been a better time to try to capture my own thoughts on ‘grab bags’.

Here’s one of the tweets that caused some online excitement last weekend.

I can’t get fully behind any advice that provides a checklist of ‘essentials’ to stick in a bag like this. In fact, I can rarely get behind any advice in checklist form because I think the real world is more nuanced; at best a checklist is a starting point.

I say I can’t fully get behind the idea; what I mean by that is I can see situations and locations where that advice (and, gasp, even checklists) is sensible, but they are not here in the UK.

In August I attended an Emergency Planning Society event and made a confession. I don’t have a grab bag packed in case of emergencies. 

The reasons for that are numerous and some of those reasons listed below. But, I genuinely would be interested in counter-arguments. Am I wrong about this? Tell me!

  • The stuff that I would find really useful is the stuff I use every day. So I’d either have to have two of everything or spend all my time packing and unpacking bags.
  • A lot of the stuff included in checklists is obsolete – a wind-up radio, in 2019? I’m going to get my news online. (What about if it’s a power cut you say? Well, even then it would have to be super widespread and of an extended duration, and in the very unlikely event that does happen, then really what use is a radio going to be anyway, all it’s going to tell me is that there is a major power cut and I’ll be like “yeah, thanks”.)
  • We’re not exposed to the types of risks that would require the kinds of evacuation where a grab bag would be useful. This is actually the biggie for me. We don’t have the types of risks that warrant 48-hour survivalism.
  • I reckon I’ve got a level of personal resilience that means I could look after myself in most situations. What this means, in reality, is provided I’ve got my phone and access to a charger there’s not a lot else that I need. (Yes, I know this smacks of privilege, I’ll get to that later).
  • I know I would be terrible at keeping something like that updated. I cleaned out a kitchen cupboard a few weeks ago and found a tin dating to 2009. Reader, I have moved house three times since then!

So, I don’t have a grab bag packed for emergencies. What I do have is a series of grab bags stashed around the house for the Zombie Apocalypse.

Wait…keep reading…

This isn’t about baseball bats with nails through them. It’s the name I jokingly give the places I store useful things, so that I know where to find household essentials – string, fuses, batteries, picture hooks, duck tape. They’re in a bag, biut I’ll probably never grab it.

As one of the contributors in the BBC article notes, we all prepare ‘grab bags’ every day. If you take a bag to work or the gym, you’ve got the things you need. If you’re pregnant you’ve probably thought about a hospital bag. If you regularly make long car journeys you’ve probably got some essentials in the boot. Grab bags need to be both personally and context-specific. That’s why checklists don’t work for me.

Now, let’s get back to that bit about privilege because this is definitely not an issue to overlook. In the last five years, food bank use has increased by 73%. Read that again. It has nearly doubled. People are reliant on emergency food every day, are they likely concerned about some possible ‘what if’s’?

Not everyone is able to pack a bag in the way that some advice encourages them to.

But now think about how would that make you feel? If you were a single parent reliant on food banks to feed your family. And you see this advice coming out that of by the way you should also have all this extra food just hanging around, and while you’re at it, that money you were going to spend on rent or whatever, no, no, invest in a wind-up radio that you’ll never use.

Of course, I do think that presonal preparedness is important (and often overlooked). But emergency response plans and the systems and processes that support them, should not be so inflexible they can’t cope if someone hasn’t thought to bring a copy of their home insurance when evacuated in the middle of the night because of a gas leak.

Emergency Management needs to wake up and see the real world. And then it needs to come up with solutions and advice that chime with a broad spectrum of people’s realities.

At its heart, the grab bag advice isn’t bad, it’s just ill-framed. Do people really need a bag packed by the front door?

Or is the message really saying “Hey, it might be handy if you’re able to put your hands on some things if you get chance and it’s safe to do so. Oh, but don’t worry if you can’t for any reason, we’ll be here to support you.”

EPS Community Resilience Event – July 2019

EPS Community Resilience Event – July 2019

Reading Time: 4 minutes

On Wednesday I attended an interesting Emergency Planning Society event loosely themed around community resilience.

It’s a term which means different things to different people and more often than not the starting place for discussion is about definitions. “What does Community Resilience mean?”

Boring.

We should instead, embrace that it’s a broad term, with varied interpretations depending on individual perspective and one which will change over time. Rather than getting hung up on what it is, we should focus on what we can do.

One of the things we can do is to be braver and more innovative. At the event Helen spoke about Naturvation, a European project looking at green infrastructure solutions to city challenges, the highlight was the unintended consequence of a Melbourne project which allows people to email love notes to 70,000 trees!

Three comments from speakers and attendees on Wednesday gave me the shivers. So I’m going to use this post to take each of those points in turn and explain my perspective, and then give a suggestion on approaching community resilience (or maybe just resilience) differently.

‘We are living in a riskier society’ – Lord Toby Harris

Lord Harris is the President of the Institute for Strategic Risk Management. He knows his stuff and is a fantastic advocate for the resilience profession. But I’m not convinced that the evidence is truly there that our world is getting more unsafe. More unsafe compared to what?

On one hand, I agree with Lord Harris that complexity is increasing and that the speed of global communication brings some new aspects. However, we should consider this against changes in demography and our collective risk tolerance.

World War One resulted in approximately 40 million casualties. The Black Death is estimated to have killed up to 60% of 14th century Europe. Baby Boomers and Millennials have experienced less real risk than nearly all generations that preceded them. Our risk perception, the things we choose to be concerned about, reflect our values as much as any objective knowledge of the hazard.

The world is definitely not without significant problems, but it’s important not to lose perspective and to understand where our rhetoric comes from and what underpins it.

‘We’ll all be living as individuals and everything will be delivered to us by drone’ – an event attendee

Lots of worrying scenarios were painted at the event – geopolitical instability, global food and water insecurity, weather extremes, tropical disease migration, antibiotic resistance…the list goes on.

For me, the scariest scenario was mentioned by an attendee; a Wall-E-style vision of the future,  where the death of cities results from us all living as individuals who never leave our confines because Amazon drones or 3D printing technology makes everything available at home.

I reject this fully. The world population is urbanising at pace. That’s a relatively new phenomenon too, of course, but as a species, we’ve lived for tens of thousands of years as societal groups and I can’t see us unlearning that behaviour any time soon, irrespective of what might be technologically possible.

The idea of ‘doing’ community resilience in the absence of community also left me incredibly puzzled!

“Spontaneous volunteers need to be controlled” – an event attendee

I called this comment out on Wednesday. I think it’s an outdated view, which cements the idea that you can command and control your way out of an emergency when in reality there needs to be flexibility, decentralisation and inclusivity.

The octopus has the most well developed invertebrate brain, but it doesn’t use its brain to tell each arm to change colour, that would take too long, instead individual skin cells sense changes in its environment and respond accordingly, which collectively gives a camouflage capability.

Similarly, the human immune system is based on individual white blood cells which go about our bodies looking for pathogens, finding and solving problems without intervention from our brains.

So why is it that when our society is faced with risk, that our approach is to introduce structure and control? Having some sense of leadership parameters to work within I agree are important. But you can achieve that through decentralised approaches too – provided people aren’t doing harm, what is the problem with them supporting the response and being enabled to do so?

So, where from here?

  • We need more ecologists in resilience.
  • We need more historians in resilience.
  • We need more complexity scientists in resilience.
  • We need more economists in resilience.
  • We need more ethicists in resilience.
  • We need better inclusion and intersectionality in resilience.
  • We need to empower people to innovate and solve problems collectively.

Resilience is naturally an incredibly broad field, it touches on so many other disciplines, all of which have lots of valuable contributions to make. We should aim to make it even broader, to bring more people into our discussion. What the resilience profession brings is a place to connect all of those dots.

Community Resilience, whatever it means to people at a given time, can only happen if we embrace how complex and messy our communities are. It can be hard for public or private sector organisations to find logical, auditable and measurable ways to ‘do’ community resilience, because of the way in which productivity and effectiveness are measured.

Our communities are filled with incredible skills, knowledge and people. We need to take a more inclusive approach and distance ourselves, at least slightly, from the neoliberal patriarchal approaches which currently dominate.

If you’d like to hear more about the event, take a look at this thread from the London Branch of the EPS for a rundown of the key discussions on the day.

Ramen Resolution – Tatami

Ramen Resolution – Tatami

Reading Time: 2 minutes

For lunch at a work event yesterday it was a toss-up between cheese sandwiches with curly edges, or literally anything else. So a colleague and I dashed over to Flat Iron Square in London’s glittering Southwark to grab a quick bite.

Flat Iron Square is one of those trendy ‘food hall’ type places where there are lots of different types of ‘street food’ under the same roof. Notice those air quotes – because I feel like these are just new words for things that existed before.

Tatami Ramen was one of the busiest places there, but I literally only had to wait a matter of minutes before my Pork Tonkotsu order was up on the counter for collection.

For takeout noodles they were actually pretty good – the broth was salty and creamy, and there were two sheets of nori rather than the standard one, and a handful of rocket. A bonus topping, which I didn’t see listed on the menu, was crispy onions, which gave a subtle caramel sweetness.

Also, because I’m bad at cropping photos, you also get to see my shoes and a little bit of Sophie’s leg!

The noodles themselves were a tad on the soft side, and as you can see above, the egg was a little overdone; but as a quick snack, you can’t really fault Tatami.

Also worth pointing out that whilst £8 for lunch is probably a bit on the steep side, I think that is the cheapest ramen that I’ve found in London in 3 years of ramen adventures.

I’ll definitely go back (I want to try the vegan ramen, which has a kombucha based broth because hipster!) and would definitely recommend if you’re at Flat Iron Square, or just in the general London Bridge area and need a bowl of ramen!

thank u, women in resilience

thank u, women in resilience

Reading Time: 2 minutes

Emergencies affect everyone differently. Race, age, ethnicity, affluence and level of education are just some of the factors which determine your vulnerability (and resilience). Gender is also a factor, with women more likely to die than men after a large scale disaster.

But this blog isn’t about that…

This morning I watched this lecture on popular misconceptions about disaster.

Another misconception that Hollywood’s gets wrong is about women’s role to cope during disaster, as shown by this parody clip:

But this blog isn’t about that either.

This is a blog written on International Women’s Day 2019, to say “thank you” to the hundreds of women I have worked alongside. Thanks for the work they do to make people safer and for everything I have learnt from them.

I can’t thank everyone individually, but I’ve picked out those whose tutelage has had the most lasting impact…

Agnes offered me a job on the same day that I met her. Nobody would call her logical, or predictable, but her dedication and passion could not be questioned. She pushed me into doing things that I was uncomfortable doing and had faith in me when I didn’t always have it in myself.

Long after meeting her, I remember still being in awe of Sue‘s experience in emergency management. As well as her ‘battle stories’, she taught me about determination and to read between the lines. She acted as a mentor more than a manager.

Over the last two years, I’ve relied on Lucy more than she realises. She sees things through a different lens, one which I feel gives greater consideration to outcome over process. She is a demonstration that sensitive, technical and complex subjects can be approached in a compassionate, human way, but still with a sense of humour.

Fiona has a pragmatic, considered and calm approach to the most challenging circumstances, and has taught me the importance of taking even the briefest moment to reflect, consider alternatives and contingencies before a decision is made. In her words “you often have more time than you realise”.

And finally, J, whose request for us to “be real” and avoid obfuscation really resonates with me. It’s something I’m trying to bring through this blog, and how I communicate at work. And something I’m still working on!

Helen, Alison, Aggie, Kate, Lynn, Gail, Brooke, Robyn, Barb, Megan, Susan…There are tons of brilliant women out there in resilience (and every field) who as well as being excellent at what they do, bring valuable and important perspectives.

Thank u.

Revisiting Red Teaming

Revisiting Red Teaming

Reading Time: 3 minutes

Red Teaming: The independent application of a range of structured, creative and critical thinking techniques to assist the end user to make a better-informed decision or create a more robust product.

That’s a kinda academic way to say “having (and welcoming) someone whose job it is to critique you”. 

I originally wrote about this in February 2017, and a lot has changed for me professionally since then. Based on recent experience, I wondered whether I would approach this differently now, has my thinking had evolved? 

A recent Twitter exchange gave me a renewed interest in this idea and so picking up on the key aspects of that discussion, I’ve revisited my previous post. 

Is a Red Team a name for something that already exists? 

Yes and no.

Decisions in emergencies (in a UK context at least) are made by consensus. So there is already a structure whereby people with different experience and responsibilities reach decisions jointly. A variety of aspects and implications will have already been considered and extremes moderated or discounted.

However, ‘decisions by committee’ typically take longer to reach and run the risk of ‘group think’ where the desire for harmony in the group results in dysfunctional decisions.

A Red Team is about doing what you normally do, what you have been trained to do; but then taking an equally qualified objective team and seeing if they have any other perspectives you haven’t considered either about the decision you have reached or the way in which you reached it.

UPDATE: A colleague also pointed out that the type of feedback that I would anticipate coming from a Red Team is can also be (although in many cases isn’t) provided in the form of post-exercise reports. However, these are painfully slow to be produced, missing the oportunity to make dynamic change.

What are the barriers to Red Teaming?

There are many, but I think they can be broadly categorised into two groups; culture and resources.

We all like to think that we have the answers, and so accepting that in ambiguous, high risk and complex situations we might always have thought of everything shows self-awareness. Adopting a Red Team approach would signify to me high levels of strategic leadership maturity.

On the resources side, sorry, I think sometimes you have to take a hit. However, this should be balanced against the cost of sub-optimal decisions being made. Arguably that’s much harder to quantify, but having a stab at working out the return on investment would be a better approach than looking at expenditure.

Clearly embedding Red Teams would take time, money and will, but should that be a barrier to doing things better?

A (red) rose by any other name…

I don’t get hung up on what this structure would be called.

I became aware of the concept through a TV drama Newsroom, where it was called a Red Team, and that term has stuck with me as shorthand.

I have mixed feelings about the militarization of civil emergency management. However, there is no escaping that Red Teams have a military connection, where they are used to good effect. Typically, where the military goes, the civil emergency response follows.

The 2010 Ministry of Defence guidance on Red Teaming states it is a “practical response to overcoming the complex problems introduced by our human frailties, helping us to recognise them and correct our thinking and analysis before faulty judgements are cemented in the minds of key decision makers.” I think that’s equally as applicable in a civil context.

Perhaps recognising a militarisation tendency, NATO has opted to call their structure ‘Alternative Analysis’. You could also think about De Bono’s Six Thinking Hats and call it White Hatting, that has a peculiar ring, but might look entertaining in a control room!

What am I doing to implement Red Teaming?

I’m not convinced I’m adding much actual substance to the conversation, other than being an advocate of ‘let’s try it’.

In a lower-key way, I made a recent decision to bring someone in specifically to check my working out on a particularly complex project at work. It was really helpful to have someone force me to reflect on my proposals, and can really see how this could be scaled up. 

I’m interested in views of colleagues on how this could be applicable and how some of the barriers could be addressed.

Standard Recovery? Recovery Standards?

Standard Recovery? Recovery Standards?

Reading Time: 2 minutes

In two week’s time, I’m moderating a conference panel session entitled Standards in Recovery: Are we getting it right and what have we learnt from recent incidents? 

This blog is an attempt to organise my thoughts and set out my own views, rather than to reach any particular conclusions!

On the face of it, standards seem like a good idea in anything; normalising complicated processes or ensuring homogenous technical precision. However, you don’t have to look too far before you realise that the issue of standards is polarizing and fraught with challenges.

That doesn’t mean they can’t be useful, just that extra care is needed in their development and application, as well as the performance management which flows from them.

Standards came to prominence around the time of the Industrial Revolution, allowing manufacturing industries to regularise processes and reduce waste. Things we take for granted are the result of standards which have developed over long durations.

I can easily conceive of, and ascribe value to, standards for ‘technical’ things. Even if I’m not an expert in the subject, I can see why it would be advantageous to standardise things like:

  • How much electricity comes out of your sockets.
  • How bright your lightbulbs are.
  • How can you be confident your eggs are salmonella free.

I can also see that standardising language/terminology would be helpful in establishing a shared understanding.

However, I find it harder to see how a meaningful standard can be developed for the complex set of processes associated with emergency recovery. Like Alice falling down the rabbit hole, there is a seemingly endless range of questions and possible answers about what recovery is, and how it should be done.

So I turned to Lewis Carrol to see if he had any wisdom…

‘Would you tell me, please, which way I ought to go from here?’ asked Alice.

‘That depends a good deal on where you want to get to,’ said the Cat.

‘I don’t much care where –’ 

‘Then it doesn’t matter which way you go,’ 

Can we really know what we’re recovering from until an incident happens? If there isn’t a fixed destination for recovery, how will we know we’re there?

So, looking forward to the conference session, here are some of the questions that I’ll have in reserve for my esteemed panel members to respond to:

  • Just what is ‘recovery’ in the context of an emergency?
  • In their experience, when does ‘recovery’ start and finish?
  • What do you think a standard for recovery would look like?
  • Should a standard for recovery be specific or allow for flexibility? If it gives too much room for manoeuvre is it really a standard?
  • Have emergency responder organisations already adopted any of the standards out there? What has been their experience and how can we learn from it?
  • Is there a danger that standards become increasingly complex over time and require disproportionate effort to maintain and measure against?

What’s your perspective on these issues? My experience is that, as a profession, recovery is overlooked in favour of areas which are arguably easier to measure impact or seen to be more exciting.

Leave a comment or start a discussion with me on Twitter.

Some thoughts on professional societies

Some thoughts on professional societies

Reading Time: 3 minutes

Getting into any career is tricky. Employers are looking for the perfect combination of both knowledge and experience. Fresh out of University you have to try extra hard to demonstrate that you can actually do the job, not just talk about it.

That was the position I found myself in almost 13 years ago. I spent countless days completing applications; labouring the point that “yes, I might have only ever worked in a shop, but you can definitely trust me not to screw this up”.

One way I could show employers that they could put their faith in me was to join a professional association. These bodies are designed to represent the interests of those in the field, so if I was a member it would enhance my legitimacy. Not one to do things by halves, I joined no less than 4 professional associations.

I did my research beforehand, of course.

Some of these organisations had a specific focus, others were more general. Some had active online communities, others were more traditional.

As a fledgeling emergency manager, I thought it was a good idea to try and learn from as much of this as possible. That way I could tell employers I not just only understood the job, but I also understood the profession and the direction it was travelling.

I’m no longer a member of any of those organisations that I joined.

Professional societies, at least those that I joined, had failed to move with the times. The challenges facing the profession now are not the same as those before critical UK legislation was introduced. The risk environment has changed, and the profession seems to be struggling to keep up.

Although, I think there were more fundamental issues holding those societies back

  1. Ego – None of these societies are sufficiently large in membership that they require the level of process that most of them have. Beacurcracy tends to override what could be helpful information exchange platforms.
  2. Identity crisis – There’s a shift towards a more holistic concept of resilience which is not reflected in the scope of the professional bodies. Emergency Planning, that’s too focused on ‘plans’. Civil Defence – that’s an outdated term from the 50’s. Business Continuity – that’s too defined by formal standards.
  3. Lack of value to members – having been associated with a range of bodies for at least the last 8 years I cannot honestly say that it has been worth the investment either financially or in terms of benefits gained.
  4. Unrepresentative leadership – those employed in emergency management when I first started my career often had military or security backgrounds. At the practitioner level that is changing, and new perspectives are being introduced, but the makeup of the decision makers in many of the professional organisations has not kept pace with the changing demographics of the field.

I don’t like to just sit on the fringes and criticise. If I see an issue I want to try and resolve it. For one of the bodies, I worked with similarly enthusiastic colleagues to solve some of these problems. However, after 18 months of trying different things and volunteering my own time, the same issues remained.

That organisation in particular alienated its members through sporadic, ill-conceived communication and disrespected its own volunteers. For a body designed to support members, it showed an extreme lack of empathy.

Contrast that with the sense of camaraderie and community I’ve seen online from my SMEMchat colleagues. This eclipses anything I have seen in over 10 years of being a member of a society.

There are, of course, many ways of doing things; I’m not simply suggesting that everything should move online. But if professionals are going to continue to support each other (and I really hope they do) then it might be time for a more radical rethink of how this is best achieved.

I feel no sense of loyalty to bodies which didn’t demonstrate any to me. However, I do feel a sense of loyalty to my colleagues, whether I work directly with them, or our paths haven’t crossed yet.

Everything that we do as a profession is a team effort. There are many ways that we can collaborate without the stuffiness of societies.

My challenge to emergency planners in the wake of Manchester

My challenge to emergency planners in the wake of Manchester

Reading Time: 2 minutes

I want to preface this short post with two caveats

  1. I think the responders in Manchester have done, and continue to do, an incredible job. Not just the emergency services, not just the NHS staff, but everyone who has helped in any way. It’s a clear demonstration of the many supporting the few.
  2. My sincere condolences are with all the families of those killed, and with anyone affected by Monday’s events. I encourage you to dig deep and donate to the appeal fund to help support them through the difficult months and years ahead.

I didn’t know any of the victims or casualties from Monday’s attack, but I did follow one on Twitter. He brought his infectious sense of humour to my news feed. His name was Martyn Hett.

Martyn was 29. Facebook was launched when he was 16, Twitter when he was 18. He, and millions of others (myself included) have grown up not just with ‘IRL’ friends, but a whole network of online friends and acquaintances. Communities for whom sharing the same geography isn’t a factor.

I’ve seen outpourings of grief online from people that never knew Martyn. I’ve also seen those people supporting each other, showing compassion and kindness. The ripples of the incident go far beyond the physical communities within which he moved.

With more of us being connected through social media (or other platforms the internet has to offer), I think this needs to be a factor in how we design emergency response.

The world, our cities, and the people within them are constantly changing. It’s difficult (perhaps impossible) for large organisations to react quickly to every single one of those changes.

My hope is that emergency planners, especially those digital natives who have grown up online like Martyn, continue to challenge current processes, ensure arrangements reflect changes in society and above all, don’t forget that you’re doing this for anyone who is affected by an incident, no matter where they happen to be.

 

What Jurassic Park taught us about cyber risk

What Jurassic Park taught us about cyber risk

Reading Time: 3 minutes

The tl;dr version of this post: don’t forget about the insider threat!

This week I attended the first in a series of three events by the Institution of Civil Engineers entitled Preparing London. This particular event was designed to consider the human threats to infrastructure.

During a talk from Nathan Jones (see this blog on his talk) my mind wandered and wondered…Did Jurassic Park teach me everything I know about cyber risk?

God damn it! I hate this hacker crap!

Ok, so maybe not everything worth knowing about cyber risk is summarised in Jurassic Park, but it’s a useful introduction into what happens when the tables are turned and technology which usually helps keep us safe, becomes the risk.

Everything in Jurassic Park is connected. The electric fences, the lighting in the visitor centre, the locks on the doors. When it’s working as planned, this connectivity helps the park’s management maintain an efficient operation and a positive guest experience.

However, such a complex system requires some centralised control.  Looking at this through a business continuity lens, this is a clear single point of failure. An inherent risk.

This has clear parallels with our modern society and the interdependencies between systems that I’ve talked about previously.

Dennis Nedry exploits his colleagues limited understanding to enact his attack. He uses his tech-savvy advantage to provide cover for him stealing intellectual property, whilst putting lots of people in danger. The ultimate lesson here is that the real monsters aren’t the dinosaurs.

Objects in mirror are closer than they appear.

As well as a light-hearted moment during the dinosaur chase sequence, I think Spielberg also snuck this in as a metaphor for risks manifesting in ways which had not been considered.

Were the Jurassic Park team aware of cyber risk? Yes, there is literally a scene about passwords. I expect a lot of  people assume that a good password is all they need for their IT security.

It’s clear they had also considered other risks, and had taken proactive action to control that risk. Electric fences, professional hunters, CCTV and motion sensors and the attempt at all-female genetic engineering are just some of the risk controls in the film.

But had the team considered the possibility that an employee would want to hold the park to ransom for personal gain? Could they have identified the vulnerability of the computerised control? Could they have done more in advance to protect the systems from malicious attack?

Dennis, our lives are in your hands.

Early in the film there are hints at Nedry’s personal financial difficulties. Later he mumbles to himself about test runs of his embryo heist.

John Hammond, the park owner recognises the power that Nedry has.

There were clearly signals which the team missed and knowledge which is combined, could have allowed an intervention before he got the opportunity to shut down the park.

Clever girl / I know this.

Just as the team hadn’t anticipated an insider threat, Nedry wasn’t expecting a tech-savvy teenager to thwart his plan.

Just when it looks like the raptors will get into the control room, Lex (the park owner’s granddaughter) recognises the Unix system and takes maters into her own hands.

The actual interface may be debatable (in researching (yes, research!) this post I’ve found that it was technically available, but I’m doubtful that a school student would have been aware), but it comes as no surprise that kids have a natural affinity with the technology that adults have to think about.

Side note: Provided the right precautions are in place to prevent unauthorised use, user friendly systems aren’t just a productivity win; they help prevent people finding work-arounds or backdoors.

Life finds a way.

With the ever increasing access to, and pervasiveness of the Internet and smart devices, Jurassic Park remains relevant today.

I’d argue that we’ve already reached a point where complete understanding of system interdependencies is impossible. Our societies and the technologies used are just too complex. However, we can continue to challenge our assumptions, keep our risk assessments grounded in reality and take action in advance to mitigate that risk.

It’s also a reminder that physical and IT security are just parts of the puzzle when it comes to risk management. Solutions are also required, sadly, to prevent against malicious attack by either insiders or outsiders.

It’s also just a really great film!