Crisis Communications for Security Issues: A Nightmare You Can Manage Marilu Goodyear Donna Liss Allison Rose Lopez Jenny Mehmedovic The University of Kansas

Copyright Statement Copyright Marilu Goodyear, Donna Liss, Allison Rose Lopez, and Jenny Mehmedovic, This work is the intellectual property of the author. Permission is granted for this material to be shared for non-commercial, educational purposes, provided that this copyright appears on the reproduced materials and notice is given that the copying is by permission of the authors. To disseminate otherwise or to republish requires written permission from the authors.

Important Elements of Response Planning Partnerships Communication But first … what happened?

The Incident Facts January 21, 2003 A technology staff member reports a compromise on the machine being used to compile SEVIS data for submission Immediately launched technical investigation The next day … Determined that the SEVIS test file had been taken as well as activity relating to movies and music

The Incident Facts File contained data from Student Information System extract matching on: Country of permanent address Presence of visa information Included some U.S. students due to mismatches 1,450 records with the following information: Name Student ID # SSN # Passport # Country of origin Visa status

Planning: Define Successful Outcomes Defined that our successful outcomes would be: 1. Protect and inform the students 2. University acts, and is viewed as, a responsible organization Gathered the right folks: Technical Staff Policy Staff Legal Counsel University Administration Public Relations

Successful Outcome 1: Protect and inform the students Partnerships Actions Student Body President Student Senate International Students Office Legal Services for Students Successes Students were involved and felt cared for No protests No lawsuits Lessons Learned Should have worked more closely with Legal Services for Students when preparing outgoing communications

Successful Outcome 1: Protect and inform the students Communications Actions Created informed team focused on incoming and outgoing communications with affected students They heard it directly from us We provided info + assistance Communication via & U.S. mail Open, frequent communication diffused student frustrations relatively quickly

Successful Outcome 1: Protect and inform the students Communications Successes Students had resources to get the information they needed They trust us more when we’re honest, even if they are frustrated They knew we were prepared and eager to help Should another incident occur, they have the expectation that we will communicate openly When dealing with potential fears, it’s better to communicate more rather than less Lessons Learned We should have been more aggressive in learning from the INS what their approach was going to be

Successful Outcome 2: University as a responsible organization Partnerships Actions Immediately contacted the INS, FBI, and the KU Public Safety Office Contacted the vendor Notified other IT professionals Gathered roundtable of administrators to address problem CIO & Deputy CIO Coordinator of IT Policy IT Public Relations Coordinator International Students Office Legal Counsel University Relations IT Security Officer

Successful Outcome 2: University as a responsible organization Partnerships Successes Assessed level of partner knowledge and know-how, and helped them look good Collaborative war-room model with all major players Did not shoot the messenger Kept the vendor name out of the press, and worked as partners Lessons Learned Your security office may know more than the FBI and Police Developed a fail-forward action plan Needed better communication with internal staff

Successful Outcome 2: University as a responsible organization Communication with the Media Actions Wrote a brief to ensure all participants received exactly the same version of events Went public within 24 hours Called press conference and started it with a strong statement from the university Brought informed student spokespeople to the press conference, so they were prepared to comment based on the facts Successes TV reporters are less likely to hunt for unknown students to fill news spots Timeliness is key to keeping coverage proportional to the incident

Successful Outcome 2: University as a responsible organization Communication with the Media Lessons Learned This is the time to use media contacts; choose the reporter when possible Pre-educate University Relations staff on the technical issues and language Law enforcement agents may not understand the technical issues, so be ready to educate them along the way The FBI has an equal interest in their own public image, and those interests may conflict with ours

Conscious communication: The (honest) underlying messages in quotes We know the facts, including which data were involved We acted quickly We are doing what we can to address the problem We are respectful of other people We are cooperating with law enforcement We accept responsibility for making it better We will continue to respect and value individual privacy, freedom of expression, academic inquiry, etc. We are providing information and/or assistance to those who were affected We sincerely regret any difficulties this may have caused you We are a responsible, competent organization

Recommendations Preparation activities Crisis communication plan Technical language – use precision Policy on whether and how to notify the affected individuals Protocol for working with University Relations, Legal Counsel, etc. Prepare communication materials After the fact Evaluate

Copyright Marilu Goodyear, Donna Liss, Allison Rose Lopez, and Jenny Mehmedovic, This work is the intellectual property of the author. Permission is granted for this material to be shared for non-commercial, educational purposes, provided that this copyright statement appears on the reproduced materials and notice is given that the copying is by permission of the author. To disseminate otherwise or to republish requires written permission from the author.