Optus cyber-attack: Could they have responded any better?

The recent cyber-attack on telco giant, Optus, has revealed and continue to demonstrate that no organisation is anywhere near clear from being vulnerable to crises. It also demonstrates, just like in many other incidents, how the data market and the appetite for it, has grown.

Data has always formed the basis for big businesses’ continuity. More so in the new cyber world, big data is big money – the bigger the data a corporation holds the more competitive advantage it has in service marketing, brand positioning, and product situating. Data helps in making informed decisions and big data is good for both legitimate business, and in malicious phishing or for ransoms.

According to reports, the Optus data breach is a result of a basic security incompetence following Optus leaving possible entry points into their system, unsecure. Unfortunately, the breach has resulted in a potentially long-term reputation and credibility damage for the corporation. As we speak, data for almost 2 million of the nearly 10 million customers risked, has already found its way out , and a further 7.7 million customers impacted in one data stream or another.

Now, what does the whole incident remind us about the damaging characteristics of crises? Well, in the modern operating environment, no corporation or business is less vulnerable to crises. As such, leadership for corporations require to be crises-ready more than they had ever been decades ago. That entails having crisis conversant executives within rank and file, but also having crisis-ready guidelines that could easily spell how information is gathered and shared with the public.

When Optus announced, on 22nd September that its customer data bank had been attacked, they seemed to have taken an internal process to accompany the announcement with an assurance to its customers. For example, part of Optus’ announcement read that:

‘Information which may have been exposed includes customers’ names, dates of birth, phone numbers, email addresses, and, for a subset of customers, addresses, ID document numbers such as driver's licence or passport numbers’

However, the coordination of information had been very problematic for Optus. It was evident the information was trickling from a disjointed source, and often incomplete. It portrayed that Optus had resolved the issue as soon as it emerged. However, that was not the case. For example, customer data had been exposed beyond what Optus initially advised. It transpired that more customer details, including Medicare details, may have been risked. Observably, it seemed Optus did not initially have a full comprehension of the depth of the crisis judging from the piece-meal communication with its customers.

The uncertain nature of crises can leave executives blurred of sense-making of what is unfolding before them. With customers still grappling for more information and alternatives for identity recovery proving slow and difficult, the amount of damage the data breach has caused to both the corporation and its individual customers is yet to be fully comprehended, and will take long to recover from. Optus will need to devise measures that minimises further harm to an already disenfranchised and uncertain customer base.

In addition, crises take a toll on organisational employees. More so on the executives, who are often the face of the corporation and brand, during crisis moments. As the Optus data breach crisis was unfolding, it was evident that the CEO Kelly Bayer Rosmarin was visibly tired, at times opting to communicate through recorded audio and videos. Optus failed to provide emotional and mental relief from such assault. Optus board could have done better by offering alternative spokesperson throughout the crisis communication. As soon as Federal Government issued its position statement, Optus board should have taken over the public engagement.

On a positive end, Optus response also cements the importance of information sharing and collaborating with stakeholders who are on your side. Optus collaborated with government agencies including the Police and other agencies to help the issuance of new documents such as a Drivers’ Licence and passports (which Optus has committed to pay for the renewal fees on behalf of the customer). In addition, the involvement of external Government agencies, such as Americas’ FBI, to help with the investigation within an Australian jurisdiction, informs how much importance the Federal Government has placed on the crisis and the security of its citizens’ data.

Crises affect corporations’ business returns, including its reputation and market share, among others. Optus may have scored in the operational response with its stakeholder collaboration in the crisis. However, with a disgruntled customer, continued bad media publicity, and a Federal Government still breathing down its neck for accountability and transparency, the crisis relief that Optus is seeking may be far out of its sight.

#crisismanagement #reputation #publicrelations #Optus #brandreputation #crisis #cyber

Sense-Making Of Crisis Situations

When a crisis strikes, it has the propensity to disrupts the ‘business as usual’ operating mode in an organisation, affecting decision making, and not the least, organisation’s ‘judgment’. The inevitability of crisis situations in the modern day global economy and the unforgiving business environment, necessitates organisations to fully embrace crisis management in strategic planning and decision making.

Apart from the potential damage to an organisation’s reputation, crises can drastically affect and physically, emotionally, and financially harm organisation’s employees and other stakeholders. Often than not, crises manifest unexpectedly. Most crises, especially where there is absence of issue monitoring, leaves organisation’s leadership grappling with ‘sense-making’ of what has just occurred. This may happen as a result of a number of reasons, including: the rarity of crises in that particular organisation or business environment; the organisation’s poor monitoring of issues that may escalate into crises; and the absence of crisis mitigating plans in the organization.

As soon as a crisis unfolds, organisation’s leaders often experience a huge sense of loss-of-control. This is normal with every crisis situations - either at personal or professional level. For example, the pressure for calculated decisions making within the shortest space of time, as the crisis unfolds, can emotionally affect leader’s perception of their control of the unfolding situation. This sense of loss-of-control can negatively impact on the emotion and subsequently the behavior of the leadership during the crisis.

As pressure for urgent decision making - as well as stakeholder’s demand for information build up - making sense of the crisis can be the catalyst for management in finding solutions and making headways in resolving an unfolding crisis. It is, therefore, very important for organisation’s leadership to expediently task itself with making sense of what is going in the organisation environment, as soon as a crisis rears its head.

Organisation’s leadership can make sense of an unfolding crisis by, among others engaging and asking themselves clear questions that generate clear answers to understand crisis cause, crisis impact, public opinion, as well as employee safety and emotional wellbeing. When organisation’s leadership swiftly make sense of a crisis, they are well placed to explain the crisis to the organisation’s various stakeholders - thereby creating deeper stakeholder understanding of the organisation’s unpleasant situation. Sense-making allows for organisation’s leadership to get the pulse of a crisis situation, and allows for making effective decisions, leading the organization through the storm.

Sense-making sets the pace to premise organisation’s response in assuaging crisis situations. As such, it is important for leadership to be on top of what is unfolding, appreciate what is happening, and figure out what needs to be done to allow for all stakeholders, including employees, to equally make sense of the crisis and participate in the recovery process at any level and in any way they can.

Employees and stakeholders that are taken on-board the organisation’s crisis recovery process can be the pressure-escape valve that sometimes an organisation needs to emotionally sway public opinion in its favour. They can become an organisation’s organic brand and crisis ambassadors.

#CrisisManagement #Emotions #Sensemaking

Dreamworld incident: Lessons in Public Relations and Crisis Management

“The secret of crisis management is not [in the] good versus [the] bad, it is preventing the bad from getting worse.” – Andy Gilman, Comm Core Group.

On Tuesday 25th October 2016, the world learned of the tragic accident at one of the world’s renowned theme parks in Australia – the Dreamworld. The death of the four (4) loving people, on the Thunder River Rapids, will always remain deeply regrettable. Looking from the outside in, the incident did not only put the (safety and organisational culture) reputation of the organisation in jeopardy, but also affected the business’ market value in the week - with shares trading low, and the park closing out to business. Crises can cost organisations their hard earned reputation, share value, and at times financial resources through remedy and litigation.

Other matter on human resourcing, and the occupational safety and health issues notwithstanding, the lead-up to the management of the crisis in this incident, is of great importance in crisis management conversations.

The question that many may want to ask is whether the theme park operator did enough in being crisis-ready. Did the organisation have a clear blue print for crisis management? Did the initial efforts match up in deescalating the emotional situation? It was perceptible during the crisis that the organisation may have knee-jerked its initial response. We can only speculate on these questions depending on the varying schools of thought and the sentiments each of us have come into touch with.

Apparently, crisis management expert recommend the need for an organisation to issue a statement (at least) within the first 60 minutes of the crisis occurring, informing stakeholders of the challenge the organisation is facing. While this particular incident happened at 2:20pm (local time) on a Tuesday of the week, management may have taken their time to prepare and issue a statement on the same. In moments of incidents of crisis, there is always great stakeholder expectation for immediate information from an organization. We, however, can all appreciate that in moments of crisis of this nature, management undergoes the process of sense-making of the situation which may affect timing of a response - from having nothing to say to crafting something to say.

However, when the statement came, it was assuring and promising - that the operator will (with collaboration) get to the bottom of the matter to unearth the root cause of the incident. Dreamworld's statement, in part, read:

"Dreamworld is working as quickly as possible to establish the facts around the incident and is working closely with emergency authorities and police to do this.” The statement further stated that "Dreamworld's focus and priority is with the families of those involved in this tragedy and will be providing an update to the public as soon as information becomes available."

This statement not only galvanized the spirit of mourning together, but also placed the crisis victims at the core of the process of remedying and unearthing the truth. In essence, it was accompanied with a promise on the part of the operator to continuously engage the public (and the bereaved) with relevant information – a very important aspect in managing crises.

A near ugly moment, though, unfolded when Dreamworld started defending the safety record of the rafts on the Thunder River Rapids, the very rafts that had unnecessarily taken out the lives of four people in the afternoon - the rafts that, regardless of having passed the safety certification, were in this moment proven unworthy for public use. Whilst such defense may have been made in good faith, it could easily been perceived as efforts to deflect blame from the organisation and its rides, as well as unnecessarily increasing speculation on what could have happened, that was not supposed to have happened, on the raft.

Opinion will always be divided on whether it was an act of great gesture for Dreamworld to come out on the same day of the incident, offering any help for funeral arrangement to the victim’s families. One may argue that the gesture was good but the timing was bad. Here were people still trying to make sense of what had just happened – trying to absorb their tragic loss, and in some instances family members were yet to be contacted. It is tempting to sit on the fence on this as one would also argue that the initiative was all about reaching out and offering a hand at this trying moment - assuring those affected by the crisis of some relief through the grieving process. Quickly followed by the initial not-so-descriptive announcement on the re-opening of the park within a day past the incident, another would also argue that the action could have easily been construed as creating a ‘business as usual’ environment, regardless of the gravity of the incident.

In the closing days of the week, there was improvement in the handling of the crisis. The operator did a good job in bringing in the parent company into the process. When an organisation falls under close media, public and government scrutiny due to a crisis incident, leadership and a leader’s presence in moments of such uncertainty play out a critical role in addressing public relations and salvaging an organisation’s reputation. Dreamworld's leadership presence signified a renewed amount of importance and responsibility placed on the incident, and further suggested the organisation’s awareness of the possible long time consequences the crisis could have on the business, if not well managed. In essence, it is more credible and trusting when an organisation’s highest level of leadership commits in addressing crisis incidents.

Needless to say, to be more effective in crisis management, it is necessary for managers leading crises to match up words with actions. The essence of crisis communication is primarily to relieve crisis victims of any anxieties, uncertainties, and ambiguities (as well as) from further emotional and physical harm, as opposed to inflaming a situation. Whilst Dreamworld management continues being present in the crisis recovery period, they however made a statement, to the effect that all families of the victims of the incident were contacted, before the process of engaging them was fully finalised. The apparent statement could have easily created a picture that the organization was interested in covering its front at the expense of the prevailing emotions in the families. It was, however, very commendable for the organisation’s leadership to accept the shortfall and acknowledge that the situation could have been handled better.

"I'd like to say that if I hadn't handled it as well as I could, we thought we were doing the right things … but if the families are watching, I have spoken to a number of them and we will look after them. I hope this is the beginning of the healing process."

"We're all here today to be part of the family to hug each other, to provide support to each other. Everybody has been moved by this; everybody is suffering from this, and is saddened."

The fact that the statement of acknowledgement was accompanied with a sense of deep regret and a somber expression was very relevant to reaching out to bereaved families and the public.

It was equally impressing that whilst making a promise to look after the bereaved families, Dreamworld was equally present to offer emotional support to their traumatized members of staff. As much as the incident shocked the world, as a crisis, it always impacts greatly on staff membership - as, in this instance, they had the duty of care and play a role in the safety of the people in their care. They, in our crisis management planning, form part of the primary victims of crisis incidents. The ensuing safety review, the subsequent delayed re-opening (until all families mourn the deceased), and the decommissioning of the ride is the deepest gesture of respect Dreamworld could have ever done to memorise the beautiful departed souls.

In one of our write-ups on ‘Leadership and Crisis Management,’ we clearly spelt out the environmental thinking that many leaders get trapped in, and the dangers that they eventually encounter for not being crisis-ready. One of the key statements that still grab the attention states:- ‘the rarity of crisis may sway organisational leadership to believe that their organisation is less prone to a crisis event until they are facing one. Some organisations do not bother having crisis management plans in place, and look at unfolding crises as just some operational issues until the immediate damage begins to show.’

We can go on analyzing the Dreamworld crisis (strategy and response) as a case study for days, months, and years to come, but the one important thing is that a strategy can only be as good as it can get and as good as its execution.

#CrisisManagement #Dreamworld #PublicRelations #PJElwyns #ReputationManagement #CorporateCulture