COVID information risk analysis - retrospective

Two and a half years ago in March 2020 as we were fast approaching our first lockdown, I published the following Probability Impact Graph depicting my analysis of the information risks relating to COVID:

The PIG reports the information risks I identified at the time, thinking about COVID from the general societal perspective as opposed to a personal or organisational perspective.

You may feel this analysis was inept, superficial, vague and pointless. "Quants" may whine at the lack of numbers and statistical analysis, no doubt berating me for the dreaded red-amber-green colouring, pointing out the assumptions, biases and various other issues with it. 

Fair enough.

Despite all that, I contend that it worked well for my purposes, namely this blog. It enabled me to identify, describe/communicate, compare and contrast the concerns I foresaw - foresaw, notice: this was a prediction, projecting forward into an uncertain future.

Today, with the benefit of hindsight, I'm taking another look at the PIG. I recognise the risks and recall my analysis. I remember some of my rationale, the reasons why I placed the issues in those particular positions relative to each other.

The collateral damage risk was the highest in my estimation, heading towards the red corner but largely in the amber zone. Digging deeper, these were the forms of collateral damage that concerned me most:

• Global economic crisis: by all accounts, we are now plummeting into a global recession with high inflation caused, in large part, by our governments spending large to bolster struggling national economies damaged by COVID, creating massive debts that will be tricky to service and clear down. Supply chain and logistical issues during COVID remain a concern as the world returns to normal (perhaps, a 'new normal' due to the great resignation and working from home?  We'll see);
  
  
• Health system collapse: I'm not aware of any total system collapses yet thanks to the tremendous resilience of health workers and systems ... but it's a close call. Here in NZ, for instance, the health service is currently in crisis facing severe staff shortages and an exhausted workforce. Although not noted on the PIG, the NZ police and fire service are also facing crises caused, I suspect, by the coincidence of societal pressures and funding shortages, both exacerbated by COVID.
  
  
• Widespread fear/panic ...: fear was and remains a factor although we largely avoided sheer panic leading to social disorder and looting thanks, in part, to concerted action by the authorities.
  
  

A little lower came increased cyber risks working from home:

• Cloud service overloads: I don't think this happened, although it's hard to tell what causes the performance reductions and delays that we notice occasionally. I believe cloud services are more resilient than I anticipated, whereas "the last mile" of our telecomms services seems less reliable - well certainly down here in rural NZ anyway. This risk was a possibility that hasn't materialised, not yet anyway, and I think I over-estimated the probability.   
  
  
• Ransomware and phishing: well before COVID, it was widely accepted that both ransomware and phishing were increasing global risks. I included them on the COVID PIG, specifically, because I thought the scammers would take advantage of COVID fears plus working from home to up the ante. In retrospect, I'm not sure about this one. There have been some incidents along those lines but the problem has not really mushroomed. Again, I think I over-estimated the risk.
  
  

I rated the FUD (Fear, Uncertainty and Doubt) and large volume of poor quality information risks similarly, with deliberate misinformation (fake news, exploitation, hidden agendas) somewhat lower. The whole anti-vaxx craziness turned out worse than I expected, in other words I under-estimated the information risks in this area. Incidents were more prevalent and caused worse problems than I anticipated, partly reflecting my own bias as a scientist with a background in infectious disease, and partly because of the (to me) surprising influence of social media which could also be a bias or misunderstanding since I'm not personally into Twitter, Facebook etc. I am perplexed at the depth of feeling in this regard, and should have paid more attention to the "outrage effect" fuelling conspiracy theories and irrational distrust of the scientific community.

Having said that, I appreciate the way that our governments and health authorities, coupled with numerous high-profile public health officials, responded to COVID with lockdown and mask mandates, and tackled the anti-vaxx movement sensitively. Collectively and individually, they stepped up to the mark. Remember, for instance, those daily TV appearances and updates by politicians flanked by epidemiologists as COVID dominated the news headlines for months on end? Three years ago, I suspect a far smaller proportion of the population would have even recognised the word 'epidemiology', or had much of a clue about infectious disease, vaccines, immunity and all that.

As to the mRNA vaccines, I am astonished at the speed with which they were developed, tested and administered en masse. Sharing of valid information among professionals is a rare example in this field of a beneficial risk with positive impacts. Without open collaboration among the scientific community, we would be in a much worse position right now. Perhaps I should have moved this risk over the left edge of the PIG.  

I'd like to discuss two other risks near the middle of the PIG:

• Mental health issues: this is another risk I think I underestimated in both probability and impact, although we seem to have dodged the bullet thanks to the resilience of strong social networks, plus positive messages of hope and support from the authorities and experts communicated through conventional and social media. However, we may have accumulated problems that could take years to surface, perhaps causing an increase in depression and suicide due to the economic problems and other COVID-related stresses such as the social isolation, furloughs and job losses. If so, it will be difficult to disentangle the causes.
  
  
• Diversion of attention from more important or urgent matters: aside from COVID and the looming recession, two other news headlines right now are the war in Ukraine and climate change. Maybe the world could have handled both issues quicker and more effectively without COVID but that is pure conjecture. No doubt there are other serious issues still fermenting but as COVID recedes, so does any consequent diversion of attention. Our excuses are fading!
  
  

So, all-in-all, I am reasonably happy with the information risks I identified and placed on the PIG. My predictions weren't bad but weren't entirely accurate either - such is the nature of risk and uncertainty.

I'm also satisfied with the subjective approach to risk analysis, and the colourful PIG. Regarding all those objective, scientific, statistical data and predictions that appeared frequently in the news during the height of COVID, the vast majority related specifically to epidemiology - infection rates, morbidity, the effects of vaccinations etc. Mostly they presented historical data with limited, cautious predictions. As to publicity about information risks, about all I can recall are some graphs about working from home, ransomware and phishing - none that I've seen were as wide-ranging or forward-looking as my analysis (please let me know if you are aware of any: i'd like to compare the methods). The background noise generated by endless marketing-led security surveys has not abated, and I remain as cynical as ever about those.

The PIG suits my purposes as a communication tool for explaining complex, diffuse, overlapping and emerging issues. The lack of hard values or even estimates on the axes is, for me, a strength rather than a limitation in the particular way I am using the PIG. Likewise, the deliberate absence of categories and category labels on the axes avoids any temptation to use spurious arithmetic to 'calculate risk levels'.  With no N-by-N grid overlay to worry about, we waste no brain-cycles wondering whether a risk should be 'a little to the left, on, or just to the right of the line'.  

What about COVID-related information risks that I totally failed to identify and analyse, though? What did I miss? Hmmmm, I'll have to cogitate on that. Meanwhile, if you'd like to point them out, challenge my analyses or poke fun at the Noddy colouring, go ahead. Comments are welcome.