It’s been a tough year for business. From ransomware attacks and power outages to cloud downtime and supply-chain disruptions, it’s never been more important to communicate to customers and stakeholders about what’s going wrong and why. Yet, with partial data and misinformation often spreading faster than official word, it’s also never been harder to deliver accurate and timely messages.

Given the complexities of this environment, I wanted to convene a group of specialists to talk about what the future of crisis comms holds for startups, technology companies and business more broadly. We had a great set of three folks discuss how to build resilient orgs, handle the decentralization going on in tech today, and how to prioritize crisis management over the mundane tasks every day.

Joining us were:

• Admiral Thad Allen, who as commandant of the Coast Guard and during his career, was commander of the Atlantic coast during 9/11, and led federal responses during Hurricane Katrina, the Deepwater Horizon oil spill and the 2010 Haiti earthquake.
• Ana Visneski, who worked with Allen on building out the Coast Guard’s first digital presence as an officer and chief of media, is now senior director of communications and community at H20.ai and was formerly global principal of disaster communications for Amazon Web Services.
• John Visneski is the chief information security officer (CISO) at Accolade and was formerly director of information security at The Pokémon Company. He served 10 years in the U.S. Air Force, where he served as chief of executive communications, and yes, is Ana’s brother.

This discussion has been edited and condensed for clarity.

Prepping an organization for catastrophe

Danny Crichton: You’ve all been in disaster communications, in some cases for decades. What are some of the top-level lessons you’ve learned about the field?

Admiral Thad Allen: Great communications and great communications people can’t save a dysfunctional organization. There’s only so much you can do with what you’ve got. I want to say that as a proviso because I’ve seen a lot of people try to communicate their way out of a problem.

The big difference between Katrina in 2005 and the Deepwater Horizon oil spill in 2010 was Katrina was before Twitter and Facebook and Deepwater was after it. In the old days, you went out and did your job. There might be an after-action report, but it was pretty much done within your organizational structure.

I’m going to really date myself. We sent forces into Somalia [around 1993]. It was the first time in history that CNN watched the people come to shore from the amphibious vehicles and I knew life had changed dramatically. There is no operation that takes place these days where the public is not part of the operation, part of the environment, part of the outcomes that are generated. If you fail to realize that, you’re going to fail right away. Anybody who’s got a cell phone enters your world of work.

So the question is, how do you think about that? That’s resulted in a significant Black Lives Matter movement with George Floyd and somebody happened to be there with a cell phone, and if that had not happened, that situation probably would not have turned out the way it did. So the question is what are we to make of that loop?

John Visneski: Generally speaking, your organizational hierarchies are not designed to be optimized for a crisis. They’re designed to build consensus. They’re designed to understand budgets. They’re designed for long-term planning. It’s the same in the military and it’s even worse in the private sector. And so there’s no concept of situational leadership. There’s no concept of who’s actually in charge during a particular crisis.

In recent attacks, the folks that were in my position, didn’t do a good enough job of explaining the technical aspects of what was going on in such a way that their organization could channel that into something that could then be translated to the public.

Ana Visneski: That’s actually called the theory of excellence in crisis communications, which is basically you have to have this transparency and this well-organized system before something goes wrong. And almost everyone doesn’t.

A good example is in 2017, when S3 broke for AWS, which is how I ended up doing crisis comms for them. I looked around and I said, “Well, why don’t we use our crisis comms plan?” And my boss said, “Our what?” And so I ended up building the critical event protocol and I built it based off the Incident Command System (ICS) that is used by federal agencies during a disaster. And essentially it was a big red button that says “Stop! Everyone get on a call, figure out who’s in charge of responding” that just unifies everyone.