JV Lucey: HSE Cyberattack remind us we need to prepare for long-overlooked risks
This year of siege has been followed by an invasion from yet another invisible enemy. Our health service, our largest Government agency, has been disabled by a cyberattack.
Times of jeopardy remind us of the need to prepare for risks we have overlooked for too long. When one hazard seems to follow another almost ‘as night follows day’ we ask ourselves about our readiness for future events. This year of siege has been followed by another invasion from yet another invisible enemy. Our health services, our largest government agency, have been disabled by a cyber-attack. While it is hard for anyone to know what to do next, I would like to suggest that the wisest approach would be to direct our efforts to sustain what Abraham Lincoln called ‘public sentiment’.
We place our trust in regulatory agencies and so we expect them to take responsibility for our ‘risk’ management. Risks’ in finance or health or information management (or any number of other potential jeopardies) take turns to grab our attention. When these groups of experts tasked to protect us fail to predict the next crisis that is unfolding in plain sight, our response is dismay. We become fearful and angry. This reaction is compounded by frustration when we see our leaders disagreeing about the correct course of action. We clamour for certainty and clarity, but clarity is not forthcoming.
Against this background, the cooperation of our people in the pandemic has been astonishing. It’s worth noting that our citizens' compliance has continued despite huge individual stresses. The evidence is that through lock-down one in five of our population has experienced significant psychological distress (including clinical levels of anxiety and depression). It is the responsibility of enlightened national leadership to sustain constructive responses during national hazards, but maintaining this popular cohesion has become an even greater challenge when we are facing a succession of unfathomable ‘risk’ events.
‘Risk management’ is not the same as ‘prediction’ of future risk. Leadership is not a matter of gazing into a crystal ball. It’s essential to understand the reality of ‘Absolute Risk’. This is the probability of an event occurring in a population.
For example the absolute risk of developing a cerebral blood clot from the J&J vaccine was estimated at one in six million. The experts were at pains to explain to us that this catastrophic event was extremely unlikely. In effect they said ‘it won’t happen to you’. At the same time when each of us plays the Lotto we take a chance of one in several millions and we are encouraged to believe that ‘it could be you’. The reality is that neither event is very likely. The absolute risk is low and deep down people understand this.
Of course blood clots in the brain are much more serious than any lottery prize, but the example serves to illustrate the humanity of our response to absolute risk. It is more useful to consider something known as ‘Relative Risk’.
This is a manageable concept. It represents the potential for an event in one particular group compared to a comparison group exposed to the same hazard. The relative risk associated with Covid-19 disease was initially under-estimated, but as the disease spread we began to learn more about the ‘R’ number. Now we all know that ‘R’ is the average number of people to whom an individual infected with covid is likely to transmit the virus. We have accepted the privations of lockdown and social distancing on the basis of a mutual interest in reducing relative risk by keeping the ‘R’ number below one. If by our collective actions we keep the R number low, even If I am infected, I know that I am unlikely to infect you, and vice versa.
Once we acknowledge the concept of relative risk, several things begin to happen.
We begin to take control over our fears. Readiness for one risk becomes less a matter of ‘crystal ball gazing’ and more a matter of rational estimation and decision making. Our individual interests become more synergistic with shared values. In other words, we realise that individual interest and community interest coincide. In the future, relative risk management should become a democratic concern and therefore more open to public debate.
This latest crisis in cyber security in the Irish health system prompts several questions about how we characterise the level of risk that we, as a community, are prepared to accept. Should we increase investment in cyber protection given that this investment comes from a finite health budget of €17 Billion (equivalent to 80% of our annual income tax) (CS0 2018)?
Hopefully, we will agree that some level of cyber-protection is an essential investment but a purely arithmetic calculation of ‘absolute risk’ will not help us to make this choice. We need a new understanding of our risks, including what it means to our public health when our cyber security is breached, the ‘downstream’ effects on other aspects of our health priorities were we to direct a greater proportion of our resources to protecting our health mega-data and whether we can live with the risk of further breaches if we do not make these additional investments.
Our public investments might benefit from this more value-driven perspective, one in which (to paraphrase Harvard professor Michael Porter) we re-consider ‘value’ as a multiple of quality of service divided by total cost.
A more utilitarian approach based on assessment of relative risks would offer a better way forward. With this approach we could justify our investments and gain support for the decision to invest in them in the knowledge of the relative risks of the alternative.
This may seem like pie in the sky but it’s not. It’s a rational and constructive approach to leadership in the face of risks that are increased by fear and denial. There are many other challenges to be faced (climate change and the rise of populism being just some examples) so we need to be prepared. Relying on the predictions of absolute risk won’t work. It is essential we understand the best way forward as a democratic society. During this ‘lockdown’ our people showed remarkable resilience in the interest of ‘the common good’. That public sentiment should not be taken for granted. We can support each other and our leadership by promoting a constructive understanding of risk. The alternative is division and the exploitation of our fears by those only too ready to misrepresent our ‘absolute risks’.
Professor James V Lucey is a Consultant Psychiatrist at St. Patrick's University Hospital and author of ‘A whole new plan for living: Achieving balance and wellness in a changing world.’
