Welcome to the SecAware blog

I spy with my beady eye ...

30 Apr 2020

Blursday metrics

The past 6 weeks or so have been quite surreal for us, and I guess for you too. Yesterday we went shopping, leaving our property for the first time since our shopping expedition a week before NZ went into "level 4" lockdown. As of a couple of days ago, we're now at "level 3". Don't ask me what the differences are between the levels, nor what levels 2, 1 and 0 might look like. All I know is that it was a relief to see other people out and about, most of us making obvious efforts to keep our distance. The new normal isn't so bad as I imagined, certainly nothing like a zombie apocalypse or police state.

Those 6 weeks blurred into one. At some point I stopped counting up and blogging about the passing days ... and eventually started counting down to the end of "level 4", or more importantly the impending exhaustion of some of our most essential supplies: coffee, wine and chocolate. Some valuable lessons there for when we replenish our "earthquake kit"!

Meanwhile, NZ's COVID-19 numbers have apparently peaked and fallen. I say "apparently" because the metrics are dubious - again, that's not just our situation in NZ, but a global issue. Differences in the way the metrics are defined, collected and interpreted are layered on top of cultural/national differences in the populations, health systems, economies and more. In particular, there are substantial differences in the amount and quality (reliability, utility) of COVID-19 testing, which is important because COVID-19 infections are cryptic: some of us are infected but have little to no symptoms and hence we don't know it, at least not right now (during the incubation period, the virus multiplies and the symptoms may - or may not - show). Some aren't so lucky and a few are seriously, even gravely ill, at which point the infection is obvious and hard (but not impossible) to ignore or discount. There's still the issue that it appears the most vulnerable patients have other "underlying medical conditions", which is the phrase of the moment and points to yet another issue with the metrics.

Two valuable metrics in infectious disease are:
  1. The rate of spread of the infection throughout the population. This is akin to the 'probability' factor in classical risk management. Essentially, it's a gross measure of the chances of anyone becoming infected. For the reasons just stated, it is tricky to measure in practice.

  2. The proportion of infected people who become sick - more specifically, sick enough to show symptoms, affect their lives, require treatment and hospitalisation, and/or die (yes, there are several related metrics here). This is akin to the 'impact' factor in risk management terms. Again, this factor is harder than you might expect to measure since some of those "underlying medical conditions" would have led to hospitalisation and death anyway, even without COVID-19. It's hard to isolate the effects of COVID-19 from other factors. Furthermore, both COVID-19 infections and the controls now in place to limit the spread can cause illness and death.
A consequence of the measurement problems is that we are forced to rely on estimation, assumption, models, simplification and criteria, in other words there are people involved in the measurement system with all that entails. Stabilisation and standardisation of the measurement processes is tough even within a small country like NZ, let alone across the whole world, and yet measurement is an essential part of managing and getting through the pandemic. The metrics inform policy makers and have significant future implications such as the rate of economic recovery as the short-term responses fade into medium and then long-term normality.

Mentioning 'policy makers' reminds me that there is a strong political angle to all of this, laying another layer of mush over the practical measurement issues noted above. The two key metrics have implications for our governments. With NZ currently months away from another general election, politicians are of course doing their level best to slope the playing field in their favour. Thankfully most seems to be avoiding the obvious temptation to cherry-pick whichever metrics best support their cause and denigrate the opposition, but I wonder about subtler political influences on those assumptions and models that underlie the measurement processes.

For example, the Swedish government took a markedly different strategic approach to most of the rest of the world, and now finds itself in the full glare of global as well as national media interest. Was this a wise strategy, or foolhardy? The politicians and advisors concerned have personal stakes in that their careers depend on how the advice and decisions are perceived, which again largely depends on metrics - metrics that are subject to manipulation and interpretation. Aside from those accountable individuals, the Swedish people and economy are clearly affected by those decisions at the top, and are naturally subject to comparison with other countries, not least their Scandinavian neighbours ... but again the comparison is not as simple as tabulating a few key statistics, especially at this crucial stage in the pandemic when bold strategic decisions are just starting to have their effects. Later, maybe decades down the line, the consequences of different national strategies should become clearer provided the data and analysis are both sound, which is far from guaranteed. Meddling with the measurement processes is just one of the ways that politicians and advisors can attempt to secure their own future, regardless of the national and global interests. There is definitely an integrity or trust angle to metrics.

As always, I'm idly thinking about the situation during lockdown and wondering about the broader lessons to be learned here. I'll jabber about those in due course, once my head clears as the first 2 cups of decent coffee in a while chase away the ghosts of last night's wine and chocolate binge. Today I'm looking forward to another home butchery lesson, hoping to re-fill the freezer without losing control of razor-sharp knives. I need all my digits: I have water to pump, logs to chainsaw, a few km of gravel track to repair, stuff to do. Besides which, typing is awkward without fingrs ...

11 Apr 2020

NZ lockdown day X of N

There's a slew of social media posts promoting business continuity management, resilience, ISO 22301 and the like, right now, during COVID-19. 

That's like promoting birth control to a family of twenty. It's 20-20 hindsight.

Now is the time to promote the planning and preparations needed to cope with the aftermath of COVID-19, taking account of things such as:
  • Lingering uncertainties/doubts about business, the economy, life, health, management and workforce capabilities/competence, supply chains ... whatever 
  • Inertia - the additional effort needed to spin-up to normal speeds after the go-slow 
  • Low morale resulting from isolation depression, sickness, stress, over-work etc.
  • Lack of motivation to 'get back into the swing of things' as if nothing happened
  • Various adjustments to the new working, home and social life
  • Coping with losses of all sorts (money, people, jobs, opportunities ...)
  • Realisation (for some) that working from home beats working from work
  • Familial, cultural and social factors
  • Long term effects such as paying back the loans needed to get through
  • Learning hard lessons from the incident, making genuine efforts to improve business continuity arrangements for the next one e.g. investing in risk management, resilience, contingency, security, change management 
  • Introspection (busily getting our own house in order) diverting attention from the (changed) outside world - new challenges, new opportunities
  • The practicalities of getting back into the nine-to-five routine and dealing with a backlog of problems, deferred work, various mini-crises and shortages etc.
Things will eventually settle down into the (new) normal. Organizations that make the transition from COVID-19 crisis to post-crisis more effectively will be in a stronger position than those that struggle with it, so what should we be doing now? 

Well, thinking about and talking through such issues is a good start, not least because it forces people to think forward ... and that's half the battle. 

For bonus marks, how about exploring, evaluating, creating and exploiting new opportunities through novel strategies, putting the emphasis even more firmly on the dawning future world before us. Like for instance, attracting and recruiting the cream of workers laid off by failing firms during the crisis, redeploying existing resources and reviewing priorities. 

2 Apr 2020

NZ lockdown day 8 of N

  • Confirmed and probable cases of COVID-19
  • The number of people who have recovered
  • How many people are (and have been) in hospital
  • Cases by District Health Board, and by age and gender.
The metrics are updated daily and reported dutifully by the NZ news media, but what use are they, in fact? What information and knowledge can we glean from the data? 

Here is the current summary (snapshot at 7am on April 2nd): 

There are no detailed definitions of these data, and my beady eye spots little differences, for example whereas the headline says "how many people are (and have been) in hospital", the data actually provided are "Number of cases in hospital" showing the "Total to date" and "New in last 24 hours". If this is a cumulative total of the number of COVID-19 cases admitted to hospital each day, are they just the "confirmed" cases or does that include the "probables"? And what is a "case" anyway? What is a "hospital"? [Yes, I know, it's a place where sick people go, and that's not important right now ... but in the more remote parts of NZ where hospitals aren't, I guess COVID-19 patients may be treated at home or in makeshift facilities: do these qualify as "hospitals" or not?].

Another concern is that they are just numbers with no clear context. That 1 NZ death, for instance: is it above or below expectations? Is it significant? Are we even sure that it was a direct result of COVID-19, or merely a coincidence? And how does NZ compare to other countries? ...

... which is an important issue in these times of global comms. Aside from occasional mentions by the NZ news media of situations in China, Italy etc., vast rivers of information are flowing through the Interweb from all over the globe - some definitive, factual and reliable, some not. All the usual comms and information security issues apply e.g. integrity failures such as errors and omissions, particularly in how the information is interpreted and discussed by non-specialists (including me, no doubt!). The Web is a giant echo chamber.

There are other concerns with the "official" NZ COVID-19 metrics but I'll stop here because I have Stuff To Do, including thinking about the reasons for measuring and reporting "official" metrics at all. I'll have more to say on this tomorrow, maybe, once I've thunk.