Operation CYGNUS – Was the UK’s Coronavirus response a failure based in assumption…?

Operation CYGNUS – Was the UK’s Coronavirus response a failure based in assumption…?
07/05/2020 Comments Off on Operation CYGNUS – Was the UK’s Coronavirus response a failure based in assumption…? CISO Blog, Operational Resilience Blog, Security Advisory Blog EditoratLarge

So much has been discussed about the Tier One Command Post Pandemic planning exercise of 2016. For those who haven’t been part of the discussion, the Public Health England, on behalf of the Department of Health delivered a pandemic planning exercise between 18 to 20 October 2016. The exercise was primarily aimed at assessing high-level strategic preparedness for an influenza (not coronavirus which is a different virus) pandemic level event. The participants were Local Resilience Forums (LRFs), the NHS and various government departments. In total, there were over 950 participants. So…what recommendations were made? Was it really suppressed? Was it even a secret report? Why did we not do better during the Coronavirus Pandemic? Well, let’s find out…

Was it a Secret Report?

No. It’s marked OFFICIAL – SENSITIVE. Official is the lowest classification for information used by the UK Government. Any suggestion it was marked SECRET is not true. For those looking for a corporate proxy, OFFICIAL – SENSITIVE information should be handled as follows:

  • Only share information with those who have a legitimate need to see it 
  • Maintain a clear desk and always lock sensitive information away
  • Only use authorised IT systems to work with or store information
  • Dispose of information appropriately
  • Only carry the information that you need when working off-site
  • Do not discuss sensitive issues in public places
  • Report lost or stolen information immediately.

Was it suppressed?

No. The report was distributed to every man and his dog. The report was sent to all the devolved administrations, government departments including Health, Treasury, DWP, CO, BEIS, DEFRA, HMRC, MoD, MoJ and quite a few others. It was sent to all the LRFs and of course, to various groups within Public Health England itself. Now did any journalists do any investigative journalism around the time of its release…a quick Google Search suggests not. I wonder what could have been happening in the second half of 2016 that could have been more interesting…

What were the issues identified?

  • The provision of epidemiological data. The way in which epidemiological data is produced and disseminated to responding organisations requires clarification. 
  • Primary Care Management. NHS England was requested to examine the impact of a pandemic influenza on the primary care system and describe how they can be mitigated. 
  • Maintaining routine vaccination programmes. Public Health England and NHS England should identify the circumstances in which they would prioritise healthcare workers and other essential services over other risk groups for vaccination.
  • Distribution of antivirals. Public Health England and NHS England should work together to further develop the existing protocols for delivery of antivirals with particular consideration being given to arrangements in the event that a high demand for antivirals means that the stockpile becomes depleted and potentially scarce.
  • Providing Secondary and Community Care. The planning around critical care is detailed and clear however, it would be useful to develop a similar level of detail around other secondary care services and supporting community care services. 
  • Impact of pandemic on secondary care. The pressure on services caused by a pandemic may be unevenly distributed across the country in a series of flu ‘hot-spots’. Mitigation plans should be considered.
  • A strategic national planning capacity for the voluntary sector. As for the social care sector, the voluntary sector is driven by planning and organisation at the local level.
  • A strategic approach to mapping social care priorities. Department for Health should work with social care partners to develop a strategic approach for prioritising local authority social care services during a pandemic.
  • Ethical Issues. It may be necessary to reduce services or levels of care in order to maintain key services, particularly at the peak of an extreme pandemic.
  • Communications. Department for Health, Public Health England and NHS England need to continue to develop a pandemic influenza communications plan and supporting resources, ensuring the certain communications aspects are addressed.
  • Four Nations planning. Department for Health, NHS England and Public Health England should continue to work with colleagues in the Devolved Administrations to ensure consistency in planning and the response arrangements across the UK.

What were the lessons [to be] learned?

  • Organisations should ensure that their Emergency Preparedness Resilience and Response training and exercising is consistent with best practice.
  • Pandemic Influenza Planning should be considered a multi-agency responsibility.
  • National level planning which considers the operationalisation of local level pandemic flu plans should be undertaken.
  • Meetings of the four health ministers and CMOs should be considered best practice and included as part of the response ‘battle rhythm’.
  • Further work is required to inform consideration of the issues related to the possible use of population-based triage during a reasonable worst-case influenza pandemic
  • Further work is required to consider surge arrangements for a reasonable worst-case scenario pandemic. 
  • The Department for Health should work with partners to further develop the strategy for the use of antivirals during a pandemic.
  • Public Health England and NHS England should continue working together to further develop the existing community protocols for delivery of antivirals with particular consideration being given to the manner in which these arrangements are communicated to NHS Emergency Preparedness staff at the local level.
  • All organisations should examine the issues surrounding staff absence to provide greater clarity for planning purposes
  • Pandemic communications plans should be developed to ensure that they provide necessary reassurance, provide adequate levels of information to the public across the UK and are tailored for specific policy interventions where required.
  • Procedures for coordination of messaging to the public should be re­-enforced and practised by Department for Health, NHS England and Public Health England national teams alongside colleagues from the Devolved Administrations
  • The communications response to a pandemic is supported by involving a wide range of stakeholders in its development and implementation.
  • A cross-government working group should be established to consider carefully the information required to guide the response. The method of situation reporting should be considered with a view to simplifying the process and avoiding duplication of effort.
  • The Department for Education, in liaison with colleagues in the Devolved Administrations, should study the impact of school closures on society.
  • Consideration should be given to the impact of pandemic influenza on British Nationals Overseas.
  • Expectations of the Ministry of Defence s capacity to assist during reasonable worst-case scenario influenza pandemic should be considered as part of a cross-government review of pandemic planning.
  • The process and timelines for providing and best presenting data on which responders will make strategic decisions during an influenza pandemic should be clarified.
  • A methodology for assessing social care capacity and surge capacity during a pandemic should be developed.
  •  The possibility of expanding social care real-estate and staffing capacity in the event of a worst-case scenario pandemic should be examined.
  • Department for Health, NHS England, CCS and the Voluntary Sector and relevant authorities in the Devolved Administrations should work together to propose a method for mapping the capacity of and providing strategic national direction to voluntary resources during a pandemic.
  • Cabinet Office, Home Office, DCLG, MOD, DWP, MOJ and Department for Health should work together to review the capabilities for managing excess deaths during an influenza pandemic, make recommendations for defining the required level of capability and the means to achieve it.
  • Further work is required in the development of pandemic contingency plans and related procedural guidance.

PPE and the impact on the social care sector were highlighted as potential issues throughout the post-exercise report.

So, what about the assumptions…

Ultimate there will always be a need for some assumptions to be made but the main assumption in this exercise, and why it ultimately led to the situation we are in now, was it was assumed we would have both vaccinations and anti-virals stockpiles in place. It does not appear to have been conceived by the planners of Operation Cygnus that a novel virus would be at the centre of the pandemic that would hit the UK.

Why does this assumption matter? It is possible the impacts to the social care sector would have been largely assumed to have been covered by a vaccination programme and those that were hospitalised would be treated by tried and tested anti-viral drugs. These assumptions would likely give responders, at all levels, a false sense of security. These intended measures, that would have likely been quite successful in an influenza pandemic, simply don’t work in the event of a novel virus outbreak.

More importantly:

Would any planners have ever assumed Care Workers would NOT want to be tested?

Yet this has happened. For what appear to be economic reasons, care workers have avoided being tested for Coronavirus on the basis that, if they were found to be infected, they would not be able to work. Certain care workers did not qualify for Statutory Sick Pay (SSP) were then put in an impossible position of either having money to feed their families and pay their rent or potentially infect a care home resident. Many would think that was an easy choice and health would always trump wealth…and therein lies another assumption. Each of our moral compasses are different. We each face our own challenges and nothing is ever black and white in the real world (even pandas eyes are brown).

If those planning exercises make assumptions, the utility of that planning activity is limited to the boundaries of how the attendees react and respond to those assumptions. Therefore another approach is needed…

Adopt the All-Hazards Approach

Ultimately, it is too early to learn most of the lessons of the pandemic. That will come in time (years, sadly) but two lessons can be learned right now. When planning for disruptive events:

1. Stop making assumptions…stop assuming anything will be in place!

Whatever your imagine or risk appetite can come up with, it can be worse, or at least a different type of crisis than you anticipated. If you’re going to make an assumption, plan for that assumption to be wrong…test until failure…then test again…and again.

2. Stop Scenario-based Planning

I get it, stories make things real for people. It conjures up an image in our minds. The trouble is that story is different for us all and that biases our expectations as to how we would cope in that situation. You may think things will go better than expected and then get caught out. Instead, use the all-hazards approach. The all-hazards approach teaches us to look at how we deal with the impact should we lose our People, Locations, Assets, Technology & Supply Chain (PLATS). Organisations can then stress test the losses all the way through to having nothing at all…

…because sometimes there will be nothing at all.

If you would like to know more about the All-Hazards Approach, get in touch.

About Fox Red Risk

Fox Red Risk is a boutique data protection and cybersecurity consultancy and Managed Security Service Provider which, amongst other things, helps client organisations with implementing controls frameworks for resilience, data protection and information security risk management. Call us on 020 8242 6047 or contact us via the website to discuss your needs.

About The Author