My rules to avoid disasters - by one of UK's top spooks
(Viking 20, 368pp) On Friday May 12, 2017, a young anaesthetist at the Royal Hospital finished his lunch of curry and chips in the cafeteria and tried to log on to his emails. He found he could not do so. Soon computers all over the hospital showed only a red screen with an image of a padlock and a message beginning: Oops, your files have been encrypted. This was the start of the devastating cyberattack on the NHS known as WannaCry. By late afternoon, more than 80 hospital trusts and 600 GP practices and clinics had been affected. This was a disaster that hit out of the blue, but it was also the result of what David Omand, in this revelatory book, calls a slow-burn crisis. The NHS had long been vulnerable to this type of cyberattack. As Omand remarks in his introduction, with something close to understatement: There is no shortage of material for writing about modern crises. In addition to cyberattacks, we also have an ongoing war in Europe, escalating environmental problems caused by climate change, not to mention the ever-present possibility of terrorist atrocities. Crisis is a word that may be overused in the headlines, but the potential for disaster is always there. And, in our increasingly connected world, disruptions can quickly arrive from anywhere on the globe. The swiftness of the worldwide spread of coronavirus is proof of that. Few people are better qualified to examine the nature of modern crises and the ways to respond to them than Omand. In a distinguished career in public service, he has been director of GCHQ and was the first UK Security And Intelligence Coordinator. His book is full of insights into the reasons why emergencies so often escalate into crises. He says people cling to the rule book when they should be prepared to tear it up if necessary. Surviving a crisis, Omand writes in a surprising analogy, is a form of spontaneous performance art in which the cast follow an outline script . . . but then improvise the details. The book covers a remarkable range of material from the failures of first France and then the U.S. in Vietnam, to the Manchester Arena bombing and the Grenfell Tower disaster in West London. One of the most terrifying possibilities he highlights is nuclear meltdown. As he points out, there have been dangerous incidents since the nuclear industrys earliest days. In 1952, a supervisor at the Chalk River reactor in Ottawa, Canada nearly caused a serious problem, as red warning lights flashed, when he asked his assistant to press buttons four and three instead of buttons four and one. Five years later, Windscale in Cumbria was the scene of the worst nuclear accident in the UKs history. Such accidents are measured on a scale of one to seven. Windscale was a five. There have only ever been two Level 7 incidents the disasters at Chernobyl in Ukraine in 1986 and Fukushima in Janpan in 2011. At Chernobyl, the Soviet governments secrecy and refusal to admit the magnitude of the problem resulted in unnecessary deaths. The Japanese were more open about the catastrophe at Fukushima but they were still criticised for the lack of preparedness. As Omand makes clear, in facing any kind of potential crisis, being prepared is all. The security operation surrounding the London Olympics in 2012, for example, was an undoubted success. When it was initially announced that the capital city would be bidding to hold the Games, many senior civil servants were alarmed at the prospect. Bid if you must, one is rumoured to have said, but for Gods sake dont win. The thought of protecting 15,000 athletes, more than 100 visiting heads of state and ten million-plus spectators, all in front of a TV audience of nearly half the worlds population, was just too scary. In the event, years of the most careful preparation resulted in a triumph. MI5 reported the gist of overheard conversations in jihadist circles: The Brits have gone crazy, over the top. We are all being watched. Brothers, keep your heads down. There were no terrorist incidents that summer. In its clear-sighted analysis of problems, How To Survive A Crisis can be an alarming read. On his first page, Omand states that we must expect a greater potential for disaster in the future. And it is hard to argue with his later comment that UK governments find it hard to plan, think and act beyond the immediate needs of the moment. However, as his title suggests, he remains an optimist. It is possible to build up a nations resilience in the face of crises, whether they are sudden in their impact or slow-burn. There is always a route to survival. WannaCry, which might have irretrievably damaged the NHS, was eventually defeated by a 22-year-old named Marcus Hutchins, a former hacker turned cybersecurity expert. He found a kill switch in the WannaCry code which stopped it from spreading.