Experts including a former chief science advisor say New Zealand's risk-management systems are flawed and we can no longer rely on our "she'll be right" mantra. By Donna Chisholm.
The email giving New Zealand 24 hours' warning of a potentially catastrophic solar flare landed in chief science advisor Sir Peter Gluckman's inbox in late July 2012. It was an alert from his UK counterpart, Sir John Beddington, advising of a severe "space weather" event known as a mass coronal ejection. A huge amount of matter had been released from the sun that, if directed at the Earth, would cause a geomagnetic storm with the potential to destroy critical infrastructure including satellites, GPS systems and electricity grids.
"He just said, 'We think there might be a solar flare coming that is directed at us. It's either going to hit the Earth or miss it.' The magnitude of the effect could be enormous."
Gluckman's role was to alert authorities to ensure they knew of the risk and could begin to address it – for example, by grounding planes or shutting down parts of the electricity grid so power plants wouldn't be fried. Outside aviation and defence, however, Gluckman says most government sectors had never even heard of space weather, let alone prepared contingency plans to offset its devastating effects.
"I have to say, it was one of those emperor-has-no-clothes moments," he says. It was a moment that has led, nearly a decade later, to the release of a critical review of the country's risk preparedness by Koi Tū: the Centre for Informed Futures. Koi Tū is a largely philanthropically funded research centre based at the University of Auckland and headed by Gluckman and his deputy, Anne Bardsley.
In their paper Uncertain But Inevitable: The expert-policy-political nexus and high-impact risks, Gluckman and Bardsley argue important risks remain unrecognised and unaddressed because of a disconnect between science and policy awareness and the political action that needs to follow. They say New Zealand is not alone in its unpreparedness – the problem is universal.
They have called for the establishment of a publicly accessible national risk register and say such a draft document was prepared over several years and ready for release in 2018, but it was shelved by the coalition government in the face of opposition from some MPs who saw it as "bad news". Gluckman and Bardsley say the MPs against it feared accountability.
"If you have a risk register, governments are accountable; they are responsible for rationally dealing with the risks that are high enough in impact or frequency to be prepared for," says Gluckman. Ideally, he says, a register details the range of potential consequences, "including those that can interact and cascade to create a crisis".
Gluckman and Bardsley say "general short-termism" has dominated the policy community "and, indeed, within New Zealand society, where the cultural paradigm, at least in Pākehā society, has been one of 'she'll be right', namely, that we will address a problem only after it emerges".
Tony Lynch, a deputy chief executive of the Department of the Prime Minister and Cabinet (DPMC), where the country's security policy is based, told the Listener that Gluckman and Bardsley were "absolutely right" in identifying the need for a public discussion on risk, but a risk register was just one of many ways that could be done.
Lynch is the government official in charge of the response to recommendations of the royal commission report on the 2019 Christchurch mosque attacks, released in December. He says much of what the commission identified in countering terrorism and violent extremism applied to many other risks.
Last year, the National Intelligence and Risk Coordination team was established in the DPMC to combine the strategic approach to terrorism and national-security threats with that of natural hazards such as earthquakes, volcanoes and tsunamis. The team was to strengthen the cohesiveness between agencies of the government's response to all risks.
"There is no one agency that has full responsibility across the four 'Rs' of emergency management [reduction, readiness, response and recovery]," says Lynch. The Christchurch earthquakes had shown we are "pretty good" at response and recovery, "but reduction and readiness are in those four as well".
Working with risk isn't new for New Zealand, he says. "Risk doesn't go away. We learn each time, so it's an area of continuous improvement. If there are criticisms and complaints, and they have been expressed not least through the royal commission report, that's important to take on board."
Although the solar flare of 2012 obviously did miss the Earth, it set off a flurry of planning for such events around the world. Previous geomagnetic storms disabled the entire Quebec power grid in 1989 and damaged telegraph services around the world in 1921.
Last year, the US Congress passed a space-weather bill to improve forecasting and protections, including equipment to shield crucial infrastructure. In New Zealand, the Ministry of Business, Innovation and Employment (MBIE) announced a $15 million, five-year research project on space-weather prediction and risk mitigation. The project is led by University of Otago department of physics professor Craig Rodger.
In the wake of the "near miss", and discussions with then Prime Minister John Key, a Strategic Risk and Resilience Panel was established in 2014 to help New Zealand better identify and prepare for high-impact risks. The development of the risk register, with an unclassified section suitable for public release, was one of its major recommendations.
After four years of effort, a public report on the register was ready for release, with forewords written by Gluckman, his successor Dame Juliet Gerrard, and Andrew Kibblewhite, then chief executive of the DPMC. Prime Minister Jacinda Ardern was believed to be in favour of its release – signified by Gerrard's involvement – but a number of members of her Cabinet were not.
Gluckman and Bardsley say a comprehensive and accessible risk register can be an essential tool for informing decisions and actions both in the policy and the public domain, but a register alone is not sufficient. "Governments must not only identify but also prepare for potential risks in a systematic and transparent way, and ensure clear accountabilities. And they must communicate their understandings to their public, agencies, local bodies and the private sector in order to increase awareness and public acceptance (buy-in) of needed investment and actions."
All too often, however, this doesn't happen. One of the biggest reasons is "inertia" around prevention. "It is inevitable that no matter how great their integrity, political actors will be biased towards putting off until tomorrow whatever can be put off – as in most other policy decisions, the question 'Why do it now?' will always be asked," their paper says.
"Politically or fiscally, the argument can be made that there will surely be enough time, or a better time, to deal with it later."
Lack of preparedness may stem from the perception that the probability of an event occurring is extremely low, or the likely time horizon too distant, giving it low "political salience".
When a truck hit a support structure on the Auckland Harbour Bridge in 2020, for example, taking out the four central lanes and throwing commuter traffic into chaos, it drew renewed attention to the need for a second harbour crossing. Yet planning for that need remains "conceptual and politically contested". Last month, the NZ Herald reported transport officials were believed to be planning a new bridge in secret, but their work was being kept under wraps for the Government to make an announcement.
When the fuel pipeline to Auckland was broken by a digger in 2017, the lack of supply lines to the city, and especially the airport, came as a surprise to many, not least in government, the authors say.
"There had been a loss of institutional memory, and no investment to maintain the preceding mechanism involving unloading fuel at the Auckland wharf, which could serve as a back-up and ensure resilience of the supply chain. The event highlighted a serious lack of foresight on the risks."
Gluckman told the Listener that the magnitude 7.8 Kaikōura earthquake in 2016 also highlighted issues that the capital hadn't been prepared for. In Wellington, liquefaction of reclaimed land at the port halted container shipping, and slips affected traffic in and out of the city.
"There was potentially a period when Wellington was going to be shut off. You could actually see continuity-of-government issues as being very real."
Another alarming event, which could have had dire consequences, was the November 2014 threat to contaminate infant and other formula with 1080 unless government agencies stopped using the poison. In 2016, 60-year-old Jeremy Kerr was jailed for more than eight years after pleading guilty to two counts of blackmail for posting the letters containing the threats along with samples of 1080.
"It took months of dissection through [the police investigation] Operation Concord – was it ecoterrorism? – and again people started to realise the role of science in risk management was quite high. Nobody in New Zealand had thought about the prospect of our major export being poisoned until Operation Concord."
Just human nature
It would be theoretically possible to have an all-encompassing register, but the pair warn that it could overwhelm its audience, or result in risks being expressed too generically or vaguely to be useful. "When lists become too long or experts clamour too much, there is a risk of being seen to 'cry wolf' and thus not be heard."
More targeted registers could make responses easier to manage, but the paper says they could also lead to unhelpful silos.
"Although risk assessments may occur internally within a specific agency – for example, the Ministry for Primary Industries (MPI) will naturally focus on risks such as biosecurity, or MBIE on the risk of infrastructure breakdown – in reality many classes of risk either span agencies, as Covid-19 has amply demonstrated, or do not clearly fall under the responsibility of a particular agency (eg. a space-weather event). There is also a need to consider how many small problems can conspire to cause one very large problem. This is perhaps one of the trickiest aspects of risk assessment – seeing the linkages between hazards, vulnerabilities, exposure and behaviour of people and systems that can compound risks."
The Listener put a series of questions to the Prime Minister's office, asking not only for a response to Gluckman and Bardsley's criticisms, but also why a publicly accessible register wasn't released as planned in 2018, whether a register was being updated piecemeal by various government agencies, and whether one would be available to the public in the future.
It did not answer those questions. A spokesperson for Ardern replied that New Zealand had a good track record of identifying and managing risks and was committed to ensuring public discussion about nationally significant risks. The DPMC's National Security Group maintained a classified national risk register, the spokesperson said, and work across government agencies would ensure a "robust and proactive approach" to identifying, assessing and managing nationally significant risks.
Gluckman and Bardsley say there are very big differences in how people perceive risk. Individuals tend to use mental shortcuts when making judgments about uncertainty, which result in systematic biases such as over-confidence. "Most people respond more to emotional cuts than cognitive processes. This can become a recipe for confusion and resistance to risk registers."
After the 9/11 terrorist attacks in the US, for example, there was an increase in road deaths in the north-east of the country because of the lay perception that flying was more dangerous than driving. "So much so that more deaths in the 12 months following the attack were due to the shift from flying to driving in the north-east US than was due to the terrorist attack itself."
But they say it's also just human nature to forget the lessons of past disasters and to underestimate losses from future hazards.
Delayed maintenance on critical infrastructure such as water pipes, and the contamination of aquifers, has also led to crises. "The Government has taken a bit of a national approach there and it's difficult because there are so many different components to the water system, but deferred maintenance is effectively what we've got in a lot of our infrastructure, and it creates risk," Gluckman says.
Although the Government has been widely praised for its response to the Covid-19 pandemic, Gluckman and Bardsley say it was relatively unprepared, for example with insufficient supplies of personal protective equipment (PPE), despite epidemiologists predicting for years that a pandemic was inevitable. New Zealanders were not alone in this, with most countries taking a relatively ad hoc approach in response.
"I think we've managed Covid quite well at this stage," says Gluckman. "But where is the advice that's now needed on behavioural science, social science and the broader problem of pandemic fatigue or lockdown fatigue and issues of mental health? Around the world, the range of people brought to the table on Covid is much broader than is the case in New Zealand."
He says, like many other countries, New Zealand had a pandemic management plan ahead of Covid, but it was based on the assumption of a flu pandemic rather than the novel coronavirus. "The characteristics of influenza are sufficiently different that New Zealand, as with most other countries, found itself inadequately prepared. In fact, much of the early responses to Covid-19 across the world were biased by the expectation that the virus would either behave like a classic influenza virus or like severe acute respiratory syndrome (Sars). Both scenarios were wrong, but it led many countries to underestimate the urgency and severity of the threat and to use strategies such as promoting herd immunity, which, in retrospect, have had tragic consequences. This highlights the fact that strategic risk management is more than extrapolating into the future with a few scenario variations – it must include contingency plans and a capacity for adaptive policies and action."
Efforts to predict how well countries were prepared for the global pandemic also proved wildly astray. The 2019 Global Health Security Index ranked 195 countries according to their expected preparedness but, in reality, the predicted top performers, such as the US, were among the worst hit.
It wasn't just because the US suffered through the woeful mishandling of public messaging and PPE supplies by President Donald Trump. According to Gluckman, the index itself was flawed. He says predictive indices are less useful than learning from past experience. Countries in East Asia acted swiftly to introduce lockdowns, increase the supply of PPE and face masks and launch public-education campaigns in large part because they had recently dealt with Sars.
Gluckman is president-elect of the International Science Council, which has established the Covid-19 Scenarios Project to convene a panel that includes representatives from the World Health Organisation, the United Nations Office for Disaster Risk Reduction, an adviser to US President Joe Biden's Covid-19 advisory board, as well as microbiologists and epidemiologists. University of Otago epidemiologist Sir David Skegg is also a panel member.
"It may have some of the big names in Covid, but it's got even bigger names in economics, social science and ethics," says Gluckman.
Former GNS principal scientist Kelvin Berryman, now a hazard and risk-assessment consultant, agrees with Gluckman and Bardsley about the need for a national risk register and was involved in the development of the draft.
"New Zealand is still creating its own disasters waiting to happen," he says. We're still building subdivisions on land prone to floods, liquefaction and coastal erosion. Buildings are being erected according to the building code – a minimum standard – but they're not resilient.
"We may have become very good at emergency management but we must get better at risk management if we are to escape the ceaseless cycle of responding to and recovering from disasters."
Our situation mirrors that globally, he says, in that action to reduce risks can't keep up with the creation of new risk because of poor planning.
For Berryman, the aftermath of the Christchurch earthquakes was a "big wake-up call" because he says it showed "the breadth and depth of the lack of understanding and the inability of people to make sensible risk-based decisions because they didn't have the knowledge base to do it with".
No one listening
Despite scientists talking about the "moderate" risk of a significant quake in Christchurch, people tended to think that if there hadn't been one in the past 20 years, then there was no risk. "But in Christchurch, the cathedral spire had been knocked over three or four times over 150 years by earthquakes. The messaging from science had been much the same, but you've got to have an audience before you can have a conversation and in quiet times it's really hard to get a conversation because there's no one listening."
After the 7.1 quake in Darfield in September 2010, people also seemed reluctant to heed warnings about aftershocks. "Despite scientists saying we aren't necessarily finished yet, there was quite a strong move to say, 'Well, we've had our earthquake, let's get over it and move on.' Nobody wanted to hear bad news. But generally, you don't know you've had the big one until you see what comes next."
Before the volcanic eruption at Whakaari/White Island, which fatally injured 22 people in December 2019, there had been a series of "near misses" when eruptions had occurred between tours to the island. "If the tour was an hour earlier or an hour later, it wouldn't have been in the midst of it, so what is acceptable risk in that situation? I don't know what the right answer is. Scientists are not the ones who determine for the public what their risk appetite is."
Berryman says the Whakaari situation was complicated by the fact the island was privately owned, and tourist operations were running businesses under their own health and safety guidelines. He says almost exactly a year after the eruption, when Ruapehu's crater lake began heating up, the Department of Conservation closed the top of the mountain "and all the tourist operators were complaining because it was affecting their business. So that's how many lessons have been learnt from Whakaari. We're not learning any lessons whatsoever."
In March, scientists published a paper assessing the risk of a new eruption of Mt Taranaki at between 1 per cent and 1.3 per cent a year – a significant risk to more than 85,000 people living within 30km of the mountain. But they said there were no "catastrophic" projections, and future eruptions should be manageable.
Berryman says some risks are obviously so great that the government does step in to set the rules, for example mandating seat belts in cars, minimum building standards and the red zone in Christchurch. Informally, the "break point" for government intervention is about a one-in-10,000 chance of death each year.
Decision-makers and communities need to interpret what might be "tolerable" so the boundary between acceptance of risk and the need to do something about it can have an "agreed, if fuzzy, boundary. There is risk everywhere and it can't be reduced to zero. But how much risk can we cope with?"
The problem is that essential communication between scientists and the public is largely unfunded. "It's not creating interesting new science, it's doing the hard yards between the knowledge that the science community has and getting it to everybody so they can make sensible decisions," Berryman says. "It's never the sexy stuff that ever gets to be funded but it's a real gap in the knowledge system."
Overall, says Gluckman, there are some risks for which New Zealand is reasonably well-prepared. Earthquakes are one, along with biosecurity issues. "We still have failures such as PSA [a bacterial disease that affects kiwifruit] but I think the MPI is well prepared in general for diseases such as foot and mouth. Our biosecurity in general is well done, but we haven't applied the lessons of that particularly well in some other areas."
However, the lack of a risk register remains a big flaw in our ability to respond to new crises. Gluckman and Bardsley suspect some government agencies are using and updating parts of the shelved risk register but they have no idea which ones.
They say many countries already use risk registers, which are partly publicly accessible. But even then, little is done to practise scenarios and little investment made to avert the risks. "Wide-ranging scenario exercises can help prepare for the heat of a crisis when decision-making is urgent."
Art form of avoidance
Then there is the need to keep assessments of risk updated in an ever-changing global environment, with cyber threats escalating over the past decade. "Because of the now-ubiquitous connectivity and many shared online services that we have quickly come to rely on, we are increasingly vulnerable," says Bardsley, who points out that cyberattacks cost billions of dollars a year.
"Threat actors are becoming increasingly sophisticated, particularly with AI-enabled tools including deep fakes and voice-mimicking software. Bad actors – some state-sponsored – can shut down financial and supply-chain systems, crippling 'smart city' networks and power grids and stealing private data."
Their paper refers to the critical need to identify the "risk owner" – the agency or person responsible for managing the risk. "Those words were anathema to the Government," says Bardsley.
In the private sector, where accountabilities tend to be direct and unavoidable, risk registers are taken very seriously as a core part of corporate governance. "But accountability is less clear in the interface between policy agencies and elected ministers. Indeed, avoiding responsibility can be an 'art form' for the policymakers and politicians. No doubt one of the reasons formal risk analyses are not necessarily popular within these communities is that they make such avoidance much harder," their paper says.
The decision to shelve the publicly accessible risk register was "sad", Gluckman says, given a public report provides a system-wide overview that typically doesn't exist anywhere else. "I think transparency matters. I think the public needs to know what the government thinks are important risks and how they can be managed. Risk mitigation is not just a matter for central government. It's a matter for local government, the private sector and for individual citizens.
"I think it comes down to the fact that New Zealand – and we are not alone in this – is not very good at long-term planning, full stop. It's always, 'Can we wait another year?' or 'Oh, we can put it off another year because there's a more urgent need.' And there's always a more urgent need."