In a previous post, I presented a couple of cases in which communicative attribution (responsibility) and technical attribution conflicted. I selected those cases specifically to show that the public (media, employees, etc.) can pick and choose whether or not to incorporate results of technical attribution in their outrage. Now, let's try to learn something to avoid these cases happening to us.
How can communication and technical attribution work together to increase the likelihood that the more accurate narrative is the one that sticks? I'm going to be focusing in on technical attribution here and discussing the larger process of incident response later. Trying to distinguish between incident response and technical attribution might be overly specific but I want to focus very closely on attribution because of its impact on public outrage.
Discovery and Disclosure
The narrative of a situation starts as soon as people become aware that there is a situation. Actually, the narrative starts before that with the reputation and history of the organizations and people involved, but that's a different post. As soon as someone becomes aware that a crisis has begun, they begin crafting an internal narrative of what happened and who is at fault. This is typically where the communicative concept of attribution takes root so driving the narrative is critical.
Benefits of communicating
At this early stage of an incident, the instinct is not to communicate anything, keep the circle small. The issue is that these incidents frequently mean operational interruptions and they occasionally (frequently?) trigger disclosure regulations which means you have to tell some people something. Proceeding silently until you are forced to communicate doesn't typically lead to effective communication. It results in begrudged, thrown together communication that doesn't fulfill any larger strategic goal. Communication should start strong with at least a generic goal or narrative in mind that can be built upon as the incident unfolds.
The next post will go into more detail about breach disclosure but a key point is: doing the bare minimum to meet regulations typically comes off as cold and secretive, or at the very least, unhelpful.
Investigation and Analysis
By focusing on just the technical attribution process, I mostly mean communicating during the the investigation and analysis stage(s) of the process. Organizations are also loathe to communicate during this stage, just as at the discovery stage. Not communicating during investigation or analysis is a valid choice: there isn't anything to communicate because the process is still in motion; maybe there are legal limitations to what can be said, especially if there's a criminal investigation happening. However, as with the discovery stage, there are benefits to communicating. Communicating intentionally and strategically throughout the process allows you to build and drive a cohesive narrative.
Caveat: Ideally the narratives being advocated are based on getting people the accurate information that they need to make decisions. I am aware that this isn't always going to be the case and organizations use information and narrative to mislead the public. I don't support that use of narrative but I know it happens.
Uncertainty
One practice that can support technical attribution is effectively communicating uncertainty. Technical attribution is a process that takes time and is dependent on many external, uncontrollable factors. Declaring attribution early, though popular, is a great way to be wrong publicly. However, failure to communicate during the process allows for other people to control the narrative of the situation. Communicating progress on the investigation adds to the organization's narrative of the incident but requires effectively communicating uncertainty. For guidance on this, I found some useful resources about uncertainty in weather and forecasts (linked below).
In the 1800's and early 1900's, weather information was reported differently, with more uncertainty, but improvements in technology and methods lead to more confidence in weather and less uncertainty being incorporated in reports. However, there is still uncertainty in weather predictions - it just isn't typically included in the reports.
Scholars have been examining whether a return to more uncertain language will lead to better decision making based on weather reports. Some people believe that removing uncertainty increases the perception that the report is about a more exact science and will increase trust. However, these projects found that people already read uncertainty into weather reports but actually prefer reports that properly communicate uncertainty over deterministic, declarative ones. People already know that no one is perfect and apply personal experiences and biases when interpreting information regardless of whether uncertainty is included in the report. There's a decent parallel here to technical attribution: an inexact process that some present as exact, sensitivity to personal experience and bias.
The NOAA report I read on this recommended that uncertainty be treated as fundamental, that multiple disciplines should be involved in communicating the information, and that educational initiatives should support these efforts. I think these recommendations can be integrated into communication about technical attribution. Specifically, working with a variety of disciplines/departments to draft messages that frame uncertainty as a natural part of the process.
Explaining the process
For most people, the process of technical attribution will be a total mystery. They will not know what to expect which will make them uncomfortable. Making people more familiar with the process will make them more comfortable with the inherent uncertainty and more patient with the process (hopefully). I spoke to a couple of people and did some research on my own about how technical attribution actually happens and I feel better equipped to understand the next breach. That research showed me that there is no universal step-by-step process for technical attribution but there are common threads in the analysis that can be shared with the public.
"At this time, we aren't prepared to attribute this breach to any particular actor. Our analysis, which is still in process, has ruled out certain parties (name them, if possible) based on (pieces of evidence that led to decision - can be vague).c Moving forward, we will focus on narrowing down the potential actors and increasing confidence in our conclusions"
As I understand it, technical attribution is more about a preponderance of evidence (50% of evidence points to a particular conclusion) than about proving beyond a reasonable doubt (ideal, but unlikely). The investigation and analysis narrows the cone of probability that a particular individual or group is responsible. Making these goals and how they are achieved clear to the public, specifically to organizational spokesmen, will hopefully adjust expectations and move the conversation closer to patience and accuracy.
Reporting
Technical attribution is complete and it is time to report findings. Reporting is an excellent opportunity to advocate a particular narrative with key audiences. While this definitely shouldn't be the first time the audience hears your narrative of the situation, final reports are the time to give a polished and cohesive narrative - as much as that is possible. It is also the time to fully walk the audience through the reasoning behind conclusions. Exposing the audience to your decision-making process allows them to follow your train of thought and determine whether that train is one they want to ride. I'll go into reporting and post-crisis communication in more detail with the incident response post. For technical attribution, communication should work alongside the process throughout and the final report should reflect that.
References
Arpan, L. M., & Roskos-Ewoldsen, D. R. (2005). Stealing thunder: Analysis of the effects of proactive disclosure of crisis information. Public Relations Review, 31(3), 425-433.
Coombs, W. T. (2007). Attribution theory as a guide for post-crisis communication research. Public Relations Review, 33(2), 135-139.
Morss, R. E., Demuth, J. L., & Lazo, J. K. (2008). Communicating uncertainty in weather forecasts: A survey of the US public. Weather and forecasting, 23(5), 974-991.
National Research Council. (2006). Completing the forecast: Characterizing and communicating uncertainty for better decisions using weather and climate forecasts. National Academies Press.
