Crisis scientist Jori Kalkman (Netherlands Defense Academy) analyzed hundreds of crisis approaches to see how operational crisis teams dealt with dilemmas. Although he does not focus specifically on cyber, there are many parallels to the crises faced by Defense and emergency services. "Because of conflicting advice, professionals face dilemmas all the time during crises," he said.
"Whether it's a large-scale accident on the highway, a war situation or a cyber crisis: a few characteristics come up again and again," Kalkman says. "First of all, there is an enormous amount of uncertainty: the situation is unpredictable; you don't know exactly what is going on and what it will look like later. The urgency is high; if you don't act quickly enough, the situation escalates or gets out of your control. This brings with it stress. For all crisis situations: you have very little or limited information, you have to make difficult choices very quickly, and the existing plans, routines and protocols are not or not entirely satisfactory."
During his research on crises, several things struck him. "First of all, that the knowledge and approach to crises are divided into columns. They are separate paths: there is research that deals specifically with the armed forces, with emergency services or with humanitarian aid, and now, therefore, with cyber crisis situations. Those different columns hardly talk to each other. Neither do the various crisis professionals, even though they have similar experiences. I think that's a missed opportunity; they can learn a lot from each other."
He also noticed the contradiction of advice. "For example, some experts advise firmly: you have to organize the approach top-down, a strong leader with the overview and who gives instructions. Another current advises the opposite: 'Give a lot of influence to the people in the operation, so they can respond flexibly.' Opinions also vary around the value of plans. 'Lay down in advance in a plan what everyone will do in a crisis,' is one view. Others again say, 'Make summary plans and build in lots of room for improvisation and flexibility.' In practice, this conflicting advice means that crisis professionals always face dilemmas during crisis situations."
The 3rd thing he noticed is that much research focuses on crisis management, but little yet on the people doing the work. "It is of course attractive to have a kind of technical focus: how do we solve crises well? But we know that crises have a big impact on the people who have to solve them."
Organizations have preferences in how they operate in crises. "Public organizations and certainly Defense like a certain amount of bureaucracy and hierarchy. That has advantages for accountability afterwards, to take responsibility and keep a sense of overview. At the same time, we know that doesn't work well in complex crises. Sticking strictly to the top-down model can hinder the effectiveness of the approach." It often works better to place more decisions with operations, he argues.
To what extent can crisis management be planned? "Some organizations have crisis plans of 300 pages, with an approach for every possible scenario. Once there is a crisis, that scenario is often not in them or no one has ever read those plans." Plans certainly have value, Kalkman observes. "It brings people together and they force them to think about what to do if things go wrong." The important thing is to build in enough room for flexibility and improvisation. Plans are especially useful, according to Kalkman, when they serve as a basis for training and practice. "People don't usually read plans, but they can practice with protocols or operating procedures. My view of plans is: writing them is 1 step, the next step is to translate them into what it means for the people who have to carry them out. That's where the greatest added value is."
Cyber approaches often have a strong emphasis on collaboration: usually information sharing between organizations and alignment of actions. "As a scientist, I find that interesting: if we are all in favor of this, why does it often fail?" Of course, organizations have reasons to avoid cooperation, even in crisis situations. "Cooperation means dependence on others: do you have the will and courage to count on them? In addition, many want to coordinate, but few want to be coordinated."
To improve cooperation, information or communication systems are usually rigged. Kalkman questions their effectiveness: "A technological solution to a social problem rarely works well. It makes more sense to look at why people avoid cooperation; the barriers they experience." Improving cooperation usually requires a combination of formal agreements and creating (more) mutual trust. "Trust is created by knowing each other better," he says. Therefore, it is recommended to exchange employees during crisis, or to sit together in the same room during a crisis. "That way you can also see each other informally, even if it's 5 minutes at the coffee machine. In large long-term crises - like covid - you can temporarily set up a new crisis organization with people from different organizations. That way they feel part of a collective, with a shared identity, vision and sense of responsibility."
The focus of crisis approaches is shifting, Kalkman observes. "It's more and more about resilience, within organizations, but also in society. This is a tricky term, because in Dutch it means both resilience and resilience; 2 different things. With cyber threats, it's often about resilience. Suppose we face a cyber attack from another state, do we have enough systems to fall back on? In other words, if there is a disruption, can we quickly get back to business as usual? That level of resilience: how do you organize that in the most effective way possible?"
Resilience comes down to people being more self-reliant or co-reliant in a crisis situation. "We do as much as we can to keep our vital infrastructures safe. But it can happen that for once we don't have power, internet, water or telecom. If you want people to become more resilient, they should actively participate in an exercise. That you say to a school, so to speak: now you have no electricity for a whole morning, what do you do? That they experience what it means when they have no access to the Internet, electricity or DigiD. Exercises like that contribute to awareness and people start to feel more responsible for their own role." That still happens too little, he sees.
