Optus cyber-attack: Could they have responded any better?

The recent cyber-attack on telco giant, Optus, has revealed and continue to demonstrate that no organisation is anywhere near clear from being vulnerable to crises. It also demonstrates, just like in many other incidents, how the data market and the appetite for it, has grown.

Data has always formed the basis for big businesses’ continuity. More so in the new cyber world, big data is big money – the bigger the data a corporation holds the more competitive advantage it has in service marketing, brand positioning, and product situating. Data helps in making informed decisions and big data is good for both legitimate business, and in malicious phishing or for ransoms.

According to reports, the Optus data breach is a result of a basic security incompetence following Optus leaving possible entry points into their system, unsecure. Unfortunately, the breach has resulted in a potentially long-term reputation and credibility damage for the corporation. As we speak, data for almost 2 million of the nearly 10 million customers risked, has already found its way out , and a further 7.7 million customers impacted in one data stream or another.

Now, what does the whole incident remind us about the damaging characteristics of crises? Well, in the modern operating environment, no corporation or business is less vulnerable to crises. As such, leadership for corporations require to be crises-ready more than they had ever been decades ago. That entails having crisis conversant executives within rank and file, but also having crisis-ready guidelines that could easily spell how information is gathered and shared with the public.

When Optus announced, on 22nd September that its customer data bank had been attacked, they seemed to have taken an internal process to accompany the announcement with an assurance to its customers. For example, part of Optus’ announcement read that:

‘Information which may have been exposed includes customers’ names, dates of birth, phone numbers, email addresses, and, for a subset of customers, addresses, ID document numbers such as driver's licence or passport numbers’

However, the coordination of information had been very problematic for Optus. It was evident the information was trickling from a disjointed source, and often incomplete. It portrayed that Optus had resolved the issue as soon as it emerged. However, that was not the case. For example, customer data had been exposed beyond what Optus initially advised. It transpired that more customer details, including Medicare details, may have been risked. Observably, it seemed Optus did not initially have a full comprehension of the depth of the crisis judging from the piece-meal communication with its customers.

The uncertain nature of crises can leave executives blurred of sense-making of what is unfolding before them. With customers still grappling for more information and alternatives for identity recovery proving slow and difficult, the amount of damage the data breach has caused to both the corporation and its individual customers is yet to be fully comprehended, and will take long to recover from. Optus will need to devise measures that minimises further harm to an already disenfranchised and uncertain customer base.

In addition, crises take a toll on organisational employees. More so on the executives, who are often the face of the corporation and brand, during crisis moments. As the Optus data breach crisis was unfolding, it was evident that the CEO Kelly Bayer Rosmarin was visibly tired, at times opting to communicate through recorded audio and videos. Optus failed to provide emotional and mental relief from such assault. Optus board could have done better by offering alternative spokesperson throughout the crisis communication. As soon as Federal Government issued its position statement, Optus board should have taken over the public engagement.

On a positive end, Optus response also cements the importance of information sharing and collaborating with stakeholders who are on your side. Optus collaborated with government agencies including the Police and other agencies to help the issuance of new documents such as a Drivers’ Licence and passports (which Optus has committed to pay for the renewal fees on behalf of the customer). In addition, the involvement of external Government agencies, such as Americas’ FBI, to help with the investigation within an Australian jurisdiction, informs how much importance the Federal Government has placed on the crisis and the security of its citizens’ data.

Crises affect corporations’ business returns, including its reputation and market share, among others. Optus may have scored in the operational response with its stakeholder collaboration in the crisis. However, with a disgruntled customer, continued bad media publicity, and a Federal Government still breathing down its neck for accountability and transparency, the crisis relief that Optus is seeking may be far out of its sight.

#crisismanagement #reputation #publicrelations #Optus #brandreputation #crisis #cyber

Dreamworld incident: Lessons in Public Relations and Crisis Management

“The secret of crisis management is not [in the] good versus [the] bad, it is preventing the bad from getting worse.” – Andy Gilman, Comm Core Group.

On Tuesday 25th October 2016, the world learned of the tragic accident at one of the world’s renowned theme parks in Australia – the Dreamworld. The death of the four (4) loving people, on the Thunder River Rapids, will always remain deeply regrettable. Looking from the outside in, the incident did not only put the (safety and organisational culture) reputation of the organisation in jeopardy, but also affected the business’ market value in the week - with shares trading low, and the park closing out to business. Crises can cost organisations their hard earned reputation, share value, and at times financial resources through remedy and litigation.

Other matter on human resourcing, and the occupational safety and health issues notwithstanding, the lead-up to the management of the crisis in this incident, is of great importance in crisis management conversations.

The question that many may want to ask is whether the theme park operator did enough in being crisis-ready. Did the organisation have a clear blue print for crisis management? Did the initial efforts match up in deescalating the emotional situation? It was perceptible during the crisis that the organisation may have knee-jerked its initial response. We can only speculate on these questions depending on the varying schools of thought and the sentiments each of us have come into touch with.

Apparently, crisis management expert recommend the need for an organisation to issue a statement (at least) within the first 60 minutes of the crisis occurring, informing stakeholders of the challenge the organisation is facing. While this particular incident happened at 2:20pm (local time) on a Tuesday of the week, management may have taken their time to prepare and issue a statement on the same. In moments of incidents of crisis, there is always great stakeholder expectation for immediate information from an organization. We, however, can all appreciate that in moments of crisis of this nature, management undergoes the process of sense-making of the situation which may affect timing of a response - from having nothing to say to crafting something to say.

However, when the statement came, it was assuring and promising - that the operator will (with collaboration) get to the bottom of the matter to unearth the root cause of the incident. Dreamworld's statement, in part, read:

"Dreamworld is working as quickly as possible to establish the facts around the incident and is working closely with emergency authorities and police to do this.” The statement further stated that "Dreamworld's focus and priority is with the families of those involved in this tragedy and will be providing an update to the public as soon as information becomes available."

This statement not only galvanized the spirit of mourning together, but also placed the crisis victims at the core of the process of remedying and unearthing the truth. In essence, it was accompanied with a promise on the part of the operator to continuously engage the public (and the bereaved) with relevant information – a very important aspect in managing crises.

A near ugly moment, though, unfolded when Dreamworld started defending the safety record of the rafts on the Thunder River Rapids, the very rafts that had unnecessarily taken out the lives of four people in the afternoon - the rafts that, regardless of having passed the safety certification, were in this moment proven unworthy for public use. Whilst such defense may have been made in good faith, it could easily been perceived as efforts to deflect blame from the organisation and its rides, as well as unnecessarily increasing speculation on what could have happened, that was not supposed to have happened, on the raft.

Opinion will always be divided on whether it was an act of great gesture for Dreamworld to come out on the same day of the incident, offering any help for funeral arrangement to the victim’s families. One may argue that the gesture was good but the timing was bad. Here were people still trying to make sense of what had just happened – trying to absorb their tragic loss, and in some instances family members were yet to be contacted. It is tempting to sit on the fence on this as one would also argue that the initiative was all about reaching out and offering a hand at this trying moment - assuring those affected by the crisis of some relief through the grieving process. Quickly followed by the initial not-so-descriptive announcement on the re-opening of the park within a day past the incident, another would also argue that the action could have easily been construed as creating a ‘business as usual’ environment, regardless of the gravity of the incident.

In the closing days of the week, there was improvement in the handling of the crisis. The operator did a good job in bringing in the parent company into the process. When an organisation falls under close media, public and government scrutiny due to a crisis incident, leadership and a leader’s presence in moments of such uncertainty play out a critical role in addressing public relations and salvaging an organisation’s reputation. Dreamworld's leadership presence signified a renewed amount of importance and responsibility placed on the incident, and further suggested the organisation’s awareness of the possible long time consequences the crisis could have on the business, if not well managed. In essence, it is more credible and trusting when an organisation’s highest level of leadership commits in addressing crisis incidents.

Needless to say, to be more effective in crisis management, it is necessary for managers leading crises to match up words with actions. The essence of crisis communication is primarily to relieve crisis victims of any anxieties, uncertainties, and ambiguities (as well as) from further emotional and physical harm, as opposed to inflaming a situation. Whilst Dreamworld management continues being present in the crisis recovery period, they however made a statement, to the effect that all families of the victims of the incident were contacted, before the process of engaging them was fully finalised. The apparent statement could have easily created a picture that the organization was interested in covering its front at the expense of the prevailing emotions in the families. It was, however, very commendable for the organisation’s leadership to accept the shortfall and acknowledge that the situation could have been handled better.

"I'd like to say that if I hadn't handled it as well as I could, we thought we were doing the right things … but if the families are watching, I have spoken to a number of them and we will look after them. I hope this is the beginning of the healing process."

"We're all here today to be part of the family to hug each other, to provide support to each other. Everybody has been moved by this; everybody is suffering from this, and is saddened."

The fact that the statement of acknowledgement was accompanied with a sense of deep regret and a somber expression was very relevant to reaching out to bereaved families and the public.

It was equally impressing that whilst making a promise to look after the bereaved families, Dreamworld was equally present to offer emotional support to their traumatized members of staff. As much as the incident shocked the world, as a crisis, it always impacts greatly on staff membership - as, in this instance, they had the duty of care and play a role in the safety of the people in their care. They, in our crisis management planning, form part of the primary victims of crisis incidents. The ensuing safety review, the subsequent delayed re-opening (until all families mourn the deceased), and the decommissioning of the ride is the deepest gesture of respect Dreamworld could have ever done to memorise the beautiful departed souls.

In one of our write-ups on ‘Leadership and Crisis Management,’ we clearly spelt out the environmental thinking that many leaders get trapped in, and the dangers that they eventually encounter for not being crisis-ready. One of the key statements that still grab the attention states:- ‘the rarity of crisis may sway organisational leadership to believe that their organisation is less prone to a crisis event until they are facing one. Some organisations do not bother having crisis management plans in place, and look at unfolding crises as just some operational issues until the immediate damage begins to show.’

We can go on analyzing the Dreamworld crisis (strategy and response) as a case study for days, months, and years to come, but the one important thing is that a strategy can only be as good as it can get and as good as its execution.

#CrisisManagement #Dreamworld #PublicRelations #PJElwyns #ReputationManagement #CorporateCulture

Public Relations? What Public Relations?

If I can confidently say that every business transaction begin with public relations, then I should be comfortable to mention that every business profit is a result of good public relations - the statement also holds true when it comes to an organisation establishing and maintaining those business connections for organisation's success and continuity.

Over the years, Public Relations has been buoyed by growing necessity for governments and organisations to improve relationships with stakeholder publics. Organisations are making every effort to establish and maintain strong relationships with those publics identified as important to organisational survival and growth. Governments and corporations invest in great public relations campaigns to create buy-ins; be it selling a not-so-popular war that attract public outrage, or building strong brand relations with the customer base to retain market leadership (respectively).

It is clear that public relations is quintessentially core to the strategic direction of an organisation, and for effective organisational management. Not only is public relations seen as a function for managing organisational relationships, but also as exceptional at offering management advise in dealing with critical issues that can be harmful to an organisation’s reputation and those relationships. As such, public relations has the audacity to advise and support management on broad policies and procedures that are favourable in creating a strong bond between the organisation and its public. It is that capacity to identify and get the feel of an organisation’s operating environment (especially where it conflicts with the public's interest and threatens organizational survival) that makes public relations strategically important in organisational management. Where public relations practitioners are engaged at top management, it is highly expected for an organisation to have policies, procedures, and actions that mutually benefit both the organization and its public.

For instance, when an organisation is faced with issues of legal consequences in nature, getting an opinion from public relations practitioners within the organisation can be the difference in the organisation’s approach towards considering a mutually beneficial outcome, to avoid reputational crises. Clearly, legal and public relations counselors approach situations from different perspectives. Where legal personnel may advise the organization to engage in ‘litigation’, public relations may prefer engaging communicating and negotiating with the other party after considering the damage litigation would bring on the corporate body and the organisation’s or brand’s reputation.

In 1994, a Greenpeace chapter of England accused one of the major and renowned fast-food chain of promoting eating habits that were perceived harmful to human health and well-being. Pamphlets to that effect were found being distributed in the streets of London by five protestors. The fast-food giant, in a legal initiative, demanded that the protestors apologise for their actions or appear in court as defendants in a libel suit. Of the five, three protestors apologised while the other two faced trial. Although the court ruled in favour of the fast-food giant, the court of public opinion ruled in favour of the protestors. Further, media outlets propelled the idea that the court case made the fats-food giant appear confrontational and bullying its own concerned customers, who had no resources to defend themselves with legal representation (instead of listening to them). It was considered one of the public relations disasters for the fast-food giant.

Effective organisational management increasingly recognise the essence of public relations in attaining organizational success and continuity. Without prejudicing internal roles in public relations, outsourcing can also bring a fresh perspective to an organisation’s public relations issues and problems. Regardless of which divide the practitioner is from, creating a great public relations campaign takes understanding the issues and problems, applying a creatively thought-out plan, and putting together an appealing execution - just to mention a few.

#Publicrelations #StrategicPlanning #Leadership #PJElwyns #BrandReputation #ReputationManagement #CorporateCulture