Unlock the Editor’s Digest for free
Roula Khalaf, Editor of the FT, selects her favourite stories in this weekly newsletter.
The writer is adviser to Gallos Technologies, and author of ‘Goodbye Globalization’
This summer arsonists set French rail lines alight. Other unknown actors tried to break into Finnish water plants, and staged a cyber attack that crippled British hospitals. Today any western company risks being targeted by hostile states, their proxies and politically motivated outfits. Just as the armed forces run exercises for all kinds of military risks, governments and the private sector should team up to model national crises.
When news arrived that the French rail lines had been sabotaged, the first thought of Tomáš Kopečný, the Czech Republic’s envoy for the reconstruction of Ukraine, was: “Is this just the first stage? Will there be more attacks?” It is impossible to know whether the unknown perpetrators have planned more attacks. We have no way of knowing which companies will be the next victims as hostile states and other actors seek to weaken the west’s open societies. It feels hopeless — but it’s not.
Governments are aware of the need for such preparation but have been struggling to figure out precisely how to go about it: which companies should participate? What should the exercises entail? They should not let the perfect be the enemy of the good.
“Until now, governments’ mindset has been, ‘we have to create the perfect exercise’,” said Charlotte Petri Gornitzka, the director-general of Sweden’s Civil Contingencies Agency (MSB). “But companies want to exercise straight away, even if it’s just a table-top exercise.” Earlier this year, Gornitzka did just that and invited the heads of Sweden’s trade associations to what one might call an alpha-version exercise.
Companies are eager to prepare for harm that may come their way. This year’s political risk survey report by WTW, the insurance broker, shows that in 2023 more than 70 per cent of the multinationals surveyed experienced political-risk losses; 96 per cent have added new political-risk capabilities; 62 per cent reported being concerned about state-sponsored supply chain disruption; and 44 per cent reported fears of attacks on infrastructure. Yes, many practise for contingencies, but that’s not enough when hostile states are at the gates.
Three years ago, Kopečný — then deputy minister of defence in the Czech Republic — tackled the challenge. “I looked at our largest companies and invited some of them,” he told me. “The exercise has to be in person. You need people to really focus. It doesn’t work if they’re doing a bunch of other Zoom calls at the same time.” Executives from the top of organisations should be involved, he said.
The key to successful exercises is good scenarios, and they should include not just crises that have already occurred but especially those that have not. “You need three-four people who know how to write an exercise and have done it before, for example military officers,” Kopečný said. “Or it could be RPG [role-playing game] designers. It’s the methodology that matters. And then you add the subject-matter experts.”
By practising all manner of national crises, the state and the private sector will be better prepared whenever hostile states, their proxies and other forces target civil society. “In a crisis, companies need to be able to work with the government,” Gornitzka noted. “We need to figure out which groupings and individuals need to establish links so they can co-operate well.” That means involving all the relevant sectors and ministers in each exercise.
Governments and businesses that have jointly practised withstanding non-military assaults should advertise the fact that they possess these skills. That would reassure markets and make prospective aggressors less interested in the pursuit.
Gornitzka’s exercise this summer was indisputably more modest than Kopečný’s full-blown version. “But it’s amazing how far we got,” she told me. Imagine the possibilities.
Read the full article here