National Resilience Committee

Thursday 11th June 2026

(began 10 hours, 53 minutes ago)

Share Debate
Watch Live
Skip to latest contribution
This debate has concluded
10:31
10:33
10:33
10:33
None Portrait Speaker 2
-

Um. I'm Nancy. Hey. I'm director of evidence and insight with Lloyd's Register Foundation's Global Safety Evidence Centre, uh, in partnership with Gallup. Uh, we run the World Risk Poll. It is. And it has a resilience index in it. This is a global survey, uh, which we've done every two years since 2019. So pre-pandemic. And the latest results will be I'll be sharing some of them today, but will be released later this year.

Um, this is a helping understand people's understanding of risk and their experience of harm globally as they perceive it. It also tells us how the UK polls and also how the UK does against 140 other countries, many of which we don't have official data for. So this is really rich information. We can also look at that alongside UK surveys like the Cabinet Office survey from 2025 on resilience, where there are similarity in questions, because we helped inform that. And we can also combine it with other data sets.

So for example, with the Resilient Cities network globally, we've been combining resilience index with other commonly used metrics on resilience. And I think what we can see from that information is that UK resilience is actually remarkably stable. Um it's one of the ten countries in the world where it hasn't really moved over those four waves of the poll over eight years, but it's not particularly high. But that is a backdrop of globally declining resilience. So not entirely a bad place to be, but within Western Europe, the North and Western Europe, we the UK is about 15th out of 17 countries on our resilience index.

So ahead only of France and Latvia of that. So it is stable but low. Um community resilience is a relative strength. Um but with a strong reliance on government. Um but what we can see is that individual planning is relatively low, although it is increasing gradually. So a third of people have a plan for what to do in an emergency that all of the household will know over ten years old, and about 40% of people in the UK are confident that they can protect themselves in an emergency.

This is about average for Europe, but this is fairly consistent with our past exposure level to disasters. So people are getting it about right for what they've previously experienced. Um, but awareness of risks is growing. So two thirds of people are concerned about, and for the first time ever, we're seeing concerns about war, uh, being a spontaneously given, uh, by an. About 7% of people. So it makes it the fourth biggest concern behind road accidents there, health and the economy.

And this is the first time we've seen that in the eight years of the data set. So the risk backdrop is changing. But people's muscle memory is not the same. So about 27 people have a plan that's gradually increasing in terms of their preparedness. And it improves after major incidents, particularly disasters of severe weather. Um, but we are about 75th out of 140 countries globally in terms of having that individual plan.
10:37
None Portrait Speaker 1
-

Thank you. Um, can I turn to Sam Weiss now, please?Hi there. My name is Sam Wise. I'm the chief strategy officer at Saatchi and Saatchi, a leading communications agency. And I guess I'm a communication strategist. And so my job, what that means is to the thing, which is, I think, often undervalued, is think about what can communications actually achieve at the outset, because you cannot make up down and black, white, you're mainly in the business of accentuating things, emphasizing things, pushing things in that direction, then working out what are the right audiences to affect that change, and then where do we need to go in order to reach those people?Um, and then finally, what are the things that we create in order to create those, um, impacts look like and creating those.

So, so that's the work of a communications strategist. And that's, I think probably the way I could best serve you guys. I think we, when we received this amazingly interesting briefing, I think our start point was that it feels like some, some things have changed in the last ten years, um, in the way that people communicate in the way that people trust certain sources of information. I think it's something we can all feel. But I wanted to come to the committee with a little bit more than feelings.

So, um, I reached out to my friend, um, who runs a company called Early Studies who do, um, research which uncovers things that are people, they have techniques which uncover things that people don't often show. Um, and it allows us to investigate things in a little bit more detail. So I would just try and add, um, to, to what has just been discussed to say some things that we've kind of looked at in relation to resilience and what we've noticed. I think the first thing is, um, people expect crisis now, or we saw some quite profound changes.

Um, if you ask people, how likely do people around you think it is that the UK will face a serious national crisis in the next ten years?Um, when you look at 2019, it was around about 30% of people saying certain or very likely. And that number is up to about 70%. If you project out to 2031. So there's a big sense that it is it is coming. Now, the other thing that I wanted to draw your attention to is the education we've all got in crisis during Covid.

So if you ask people, when you think about a major crisis hitting the UK, um. What are the things that people around you would worry about the most?Now, there are some baseline factors which you would expect to hold the same. And they do hold the same. Their personal physical safety, the safety of their family and immediate community. These are the top things and they come up quite high. But what we can see really increasing is more of this nuanced understanding of the impact of crisis.

So when you look at, um, I mean short term. Disruption, I would think is quite obvious, but longer term economic damage to their finances or job, that's a second order thinking, um, breakdown of social order, even more of a kind of nuanced, um, collapse of public services and even loss of cultural stability and national identity. People have a quite a nuanced understanding of how this is going to affect them. And the third, the third point I wanted to raise is, uh, and we. I think is quite stark is a, is a sort of collapse in people's belief that central institutions are going to be well placed to handle it.

And I think we can feel that. But, um, I can put a few numbers on it when, when you talk to people, if such a crisis came, how confident are people around you that the country would respond effectively?Very confident and cautiously confident in 2019, some to about 65%. So that was a majority of people, about two thirds of people thought it would be okay. If you look now, it's down to 28%, but only 3.5% of people are very confident that the institutions would hold.

And I think when we're doing communication strategy, what we look for is a tension like that. So one thing is going up and the other thing is going down, and that creates a need to do something different. And I think that's a sort of really the heart of, of what I would talk to you, I'd like to talk to you about today and some of the implications, and will inform my answers to further questions.
10:41
10:41
10:42
10:42
10:44
None Portrait Speaker 1
-

Of course. Frustratingly, I think often the answers to, to, to difficult questions tend to be and answers rather than or answers. Because I do think there's obviously a role for, uh, for centralized communications, but I think we can see a big drop off in how much people listen to those. Um, you know, the bone structure of an effective communications campaign for behaviour change is still the same, right?You need specific achievable actions that people can take, which are memorable, that can stick in their head, hence sort of slogans.

It needs to be linked to something they already value or worry about, and then it needs to be carried by a messenger they trust. Now the problem we've got is the the change of where that trust lies and all the data we look at everything centralised, whether it's, you know, national broadcasters or the PM is declining and everything which is closer to you is increasing. I mean, just to pull out a couple of interesting stats, um, when someone, something serious is happening, who do the people around you actually turn to first for information?So this is just access to the information.

It's not about credibility, but national television going down from 82.6 to 50.8. This is something that, you know, we've seen we've all seen it's been happening for a while, but change happens kind of gradually. And then all at once. Right. Um, and then, but family and friends via WhatsApp or messaging going 33% up to sort of almost 50%. So when we think about communications, we try and think about communications in four ways. So there are paid communications, which are campaigns that you put out.

Your kind of your ad campaigns. There are earned communications, which is more PR. So it's somebody else talking about you. It might be doing an interview or whatever. There are shared communications which are designed to live in a social space, and you have to accept that you cannot completely control them. You are looking for people to interact with them. And then there are owned ones, right?Which is your website as well. So, so paid and owned are things that you can control very much.

Whereas shared and earned are things that you have to. And it's very hard for people and businesses to do this. You have to relinquish a certain amount of control in order to sort of set them free into the environment. And, and that's how so, so it's, it's, it's a layering of these kind of things. And I think really getting the kind of indirect communications going and indirect communication strategy going is the, is the major thing I think needs to be added.
10:47
None Portrait Speaker 6
-

I just asked.
10:47
10:47
None Portrait Speaker 1
-

Um.
10:47
10:48
10:48
10:49
10:50
10:50
None Portrait Speaker 5
-

This is fascinating.
10:50
10:51
10:51
10:52
10:52
10:52
10:52
None Portrait Speaker 2
-

There wasn't um, not a huge difference actually. Um, but I think you're absolutely right to say that in the UK, people are much more likely to see the resilience of something that the institutions do national and local government do the there wasn't a great deal of difference in terms of national and local government, but local government was slightly more trusted in terms of preparing. We've got measures about, um, how confident are you in their preparedness?So what's interesting is people are more likely to think it's government's job, but actually don't necessarily feel that they are particularly confident in their level of preparedness.

And I think this is quite difficult for the UK, where our national critical infrastructure is actually quite a fragmented delivery system. So there is a risk around that ability to directly control it um as well. So I think that is a challenge. The words people use and understand in terms of resilience are definitely something that is people don't connect to it. I think one of the biggest challenges in the UK, particularly where we've got people who don't know what to do in an emergency, there is no individual muscle memory.

There is a community one. We know where to volunteer and we saw that in the pandemic. But the individual when we don't actually know. So it's not necessarily a motivation one. It's an understanding of practically what you do. So it's it's gradually creeping up. But I think there's something quite particular about actually, this is what you need to do in response to that concern, because we don't have that.
10:54
10:54
None Portrait Speaker 4
-

Defer to Sam if.
10:54
10:54
None Portrait Speaker 7
-

Okay.
10:55
None Portrait Speaker 3
-

Okay. Um, quickly.
10:55
10:55
10:56
10:56
10:57
10:57
None Portrait Speaker 2
-

So I understand civic values to be about sort of societal and community resilience. And actually, it's one of the UK's relative strengths globally we've got and it's held stable over the eight years that we've polled the UK, about 80% of people, um, think most of their neighbours care about them and their well-being. And that is very high compared to um the global medium, under, under 70%. And we're about 20th, 21st in the world at that. And so despite what we're seeing that it is a relative, the strong side of it.

So that's how I would understand civic value. That individual one is the is the gap. Um, and so for me, part of it is about people just don't know. So there isn't the muscle memory there. So the example I would give is in the floods in Spain recently, people did what they thought was the advice last time, which wasn't very recent. So they all went to the basements, which was exactly the opposite thing that they should do. So that's what I mean about a muscle memory.

We've got the memory of volunteering. We know how to help out in our communities. And we saw that in the pandemic. We don't have that on the individual side in the same way. Um, and I think that is something we actually kind of have to teach a little bit because we've got it about right. But I would say that risk communication bit, there is a lot of science around and practice around risk communication and helping people prepare. So we fund something called the risk Know-how project that has a lot of experience about how you help people communicate that.

And people are often making very, very complex risk decisions about whether they go to work or not. And, um, and they're dealing with multi-hazard risks in their own individual circumstances. And that multi-hazard risk is a really important one. So the example I would give is in the hurricane in Jamaica recently, they were worried about flooding. So they moved everyone to the top floor of the hospital. But then the roof blew off the hospital. So what do you do in those circumstances where you've got multiple hazards happening at once?And there that science is expanding, but we need to learn from it really fast.
11:00
None Portrait Speaker 3
-

Right.
11:00
None Portrait Speaker 1
-

Um, I would say this is a kind of, uh, bad news, good news sort of story, right?Um, and I would say the bad news is, um, is that there is, there's a reference to already a sort of lack of faith in direct government communications, certainly a decline in it. You know, when we ask people, what do we think is driving government communications the sense that we're genuinely trying to keep people safe is declining from about 52% to 31%, whereas the sense that it is about what's driving it is the desire to protect themselves from blame and legal implications.

43% to 57%. So what can we do is start to try and embrace indirect forms of influence. I think is would be my answer. Alfred touched on something which is a trend that is a mega trend that we can see in all walks of life, and a lot of what many private companies are doing is trying to cater to this, where people are taking the organizations that they used to rely on, whether that's in terms of health or their retirement. Um, or their education and things that used to be done in a centralized institutional way.

And they're taking responsibility for them themselves because they think that they should, they can handle the complexity, often empowered by technology and that, that, that they can take that on themselves. So you're seeing people challenging, you know, minor legal disputes using ChatGPT. You're seeing family crises with a loved one in hospital using Claudes to try and interpret the medical and the doctors coming in. And you know what?Three potential diagnoses are coming up. And it's when handled, right, this transfer of responsibility from the center to the individuals is felt as very empowering.

Um, when it's handled poorly, it feels like you're dodging responsibility, but I think it is, is, um, incredibly powerful. How, how much we're seeing this, um. If we ask the question in which areas do the people around you feel they are increasingly making their own decisions?So I mean, it's so stark, you know, 30% to 61% in health and medical decisions. You know, you've sat around a dinner table. Now there's more diets than people. You know, what we eat is different.

What we eat is different. How we exercise is different. What we think we need from a health perspective is different. But even things which should be, you would have thought were completely collective, like education, you know, education and what your children learn 21%. So only a fifth of people would have thought that was something they should decide themselves. But now, I mean, I haven't sat around a dinner table where people are clear about what their kids should be doing in the future.

For a long time, it's about 50% of people now think that's something they should try and take into their own hands. So all the companies that are helping people doing that are doing really well, and we work with several of them. But that idea that what the way to influence people's resilience is to help foster their own resilience and help them to, to empower them to do it themselves without looking like you're dodging the responsibility. Of course.
11:03
11:03
11:05
11:06
11:07
11:08
None Portrait Speaker 3
-

Thank you.
11:08
11:08
11:08
11:08
11:09
None Portrait Speaker 1
-

So, um. I think that's, it's absolutely the right instinct is that messages need to be tailored to different groups. I think we need a slightly more sophisticated way of looking at what those groups are, which I think I've touched on. You know, I would be classed in a vulnerable group. I'm a wheelchair user, but within that group, there are people who have to drive themselves around using tennis balls and electric wheelchairs and require a lot of help. There are very elderly people, and there are people who would consider themselves activists.

Isn't a group that I ever applied to be a member of. In fact, the only thing that disabled community can really agree on is that blue badge parking abuse should be punished by death. I think there's a way of defining a group externally, and then there's a way of defining a group internally. And I think it's much more helpful to look at what people shared values are and what motivates them. Um, and I think that's the start point of mapping what those audiences of influences are.

We have to divorce a sense of a geographical map and start thinking about a digital map of, of communities and how, who people cluster around and who are the important voices in those, and which communities are the most important to do so. And that's, I think, step one of doing that. Then, then what we would try and look at is we talked about paid and owned shared, you know, for example, very wealthy people would tend to buy us more towards owned media, right?They don't want to hear what somebody else says.

They will go straight to the, to the site and get the information for themselves. And so they have a different spread of influence. So you need a sense of not just who the audiences are, but what are the places and people with which to influence them. And it is it is a job of work to do that. But I think that's, that's a job of national preparedness so that you can pull those levers. So you talked about Sweden.

They have their K companies. You need something similar for for communications network of influence because as Alfred said, it's you want to have the domain authority. You want to be the one releasing the information, which is going to then influence all these other people to have, even if it's not the same message, a coherent message, because everything we see, what people now want in order to believe something is not the same message 15 times, which is the sort of classic communication strategy. What they want to see is messages which resonate with each other from different sources.

That that that phrase, do your own research. What that means is you want to see something in a number of places, and then you can triangulate that it's kind of true. So what you're trying to do is, is influence and seed stories, which can happen in different places. And so there's an expression we use a lot, which is if you want to gain influence, you have to surrender control. The two things are kind of counter to each other. And it's very hard for, for institutions to do that.

But it is necessary.
11:12
11:12
None Portrait Speaker 2
-

Um, I've talked a little bit about where people trust things before, but people making people every day make complex decisions in very complex environments for their own benefit as well. So that's kind of what I referred to in the risk know how information people are making these decisions. Sometimes it's about information, sometimes about who they trust. And you can see in the science on trust that, um, you can have the same information from different messengers with very, very different outcomes. And so it does matter who the people are.

So the content and the audience definitely does matter. I think, um. Where we're, we're particularly the bit, the group of people who I was particularly concerned about was in terms of their level of preparedness was 15 to 25 year olds, um, who were least likely to have a plan and probably quite unlikely to trust, uh, authority places as well. So I think that would be a group of people who I would be particularly concerned about, but also people who don't necessarily have access to information or because they're just above the very poorest, so they're not in the target group of population that would particularly be vulnerable.

Just above that, don't always get the information they need to make the best decisions for them, and are often making very complicated decisions about whether they go out to work because they need the money. So I think thinking very carefully about who people are in lots of different spheres of their lives, they're not just one thing as well. Thank you.
11:14
11:14
11:14
11:15
None Portrait Speaker 8
-

Thank you.
11:15
11:15
11:16
None Portrait Speaker 1
-

Yes, I.
11:16
11:16
11:17
None Portrait Speaker 1
-

Um, so. Perhaps a little controversially, um, something we talk about is one person's misinformation is another person's activism, like you can take the same event and even just in mainstream media, you could see it reported in the Guardian and the Daily Mail and see two completely different versions of things. So I think you've got to have a distinction between, you know, disinformation, which is malicious. And, and what can be loosely called. Misinformation where people are putting out things which are not necessarily true.

I think. What you should be trying to do is bring people closer, not trying to control them, but to, to be the source of information. You have a power over them in, in the information you're able to give them. Um, and if you're able to relinquish some control over what their exact narrative is, then you can start to make things more coherent over time. I think a lot of what we've seen, there is another part of it, which I think Alfred is really well placed to, to, to speak to, but there is a, there is also a danger of the confidence, which I'm sure we've all encountered in our lives, that people who don't really know anything about a subject get very quickly with the power of LMS.

Um, sort of artificial intelligence, confidence. Um, and that is one of the things which really heightens the importance of understanding what are the sources that are driving the, the recommendations of LMS and making sure that those tie back to things which can have really accurate information and where the, the domain authority and the speed of update and the liveness is all. You know. Set by the government directly.
11:18
11:19
11:19
None Portrait Speaker 6
-

Um, it's fairly anecdotal now, but when we look at misinformation and disinformation on, on the election in 2016, I believe in the US. Um, I think most of the headlines was about the amount of disinformation which we found across data from, from YouTube, Google, Facebook and Twitter. That was actually very little off. Um, but what there was an enormous amount of which was, um, kind of brushed away was misinformation. And misinformation in bubbles. So you had these echo chambers where everyone was, was using numbers that they had found somewhere that they believed to be true, to convince each other even more that they all agreed on something.

So that was kind of like the first time we really saw that, how these incredible kind of like separate and distant worlds were created who have completely different ideas of what the world looked like. Um, I think something that has happened since is that we've had both a generation who's grown up online, uh, who doesn't know a time where there was a central source of information. They have grown up with 20, and they know full well that someone on that they should check out a right wing opinion and a left wing opinion.

And the truth is somewhere in the middle. Um, we often use an anecdote back then about Finland. How come they virtually have like zero disinformation being bordering with Russia?Um, and they learn critical thinking in the national curriculum from, from the start school to question the information they receive and how to do so to, to create their own opinions. And I think that's almost become like, it might sound almost like absurd, but like this critical thinking, native generation that has had so information.

So they've been forced to build up tools for managing it. And there are, of course, the most of the stories we hear is about people who don't manage, but I think they are a very small minority. When we've done research recently about people's worries for misinformation, most of it is from young people about their parents who have not grown up with a stream of voices from everywhere. But meanwhile, the parents think they're the ones who need to be worried about the children. Um, so I, so I think that's, that's, um, um, younger people are taking care of it.

Um, the other thing that I think is something we will start to see going back to LMS and to ChatGPT and Claude, etc., we have a couple of interesting phenomena coming up there. And I think maybe in three years time, we, we're talking about mis generation or generation i.e LMS, creating information, uh, either from a nefarious purpose. If you have, um, models that comes from authoritarian regimes, for example, um, or um, that you have it from, from various different biases that's going to, and the only thing they have in common is that they need information.

They, they don't have it themselves. They generate it from existing information. So I think that goes back to the role of information and what the information the government provides and how and how it is structured. Um, I think that's going to be absolutely crucial. Yes, I think that was my point.
11:22
11:22
None Portrait Speaker 11
-

Yes. Um, thank you very much for the presentation so far. It's very, very interesting. Um, I want to talk. Just ask you for your reflections on perhaps some international, um, uh. Aspects of misinformation and disinformation. I've just come back from Armenia. Um, where with the OSCE, the organization for Security and Cooperation in Europe. Um, I was a short term observer in the election there, and previously I had done that in Moldova.

In both countries, but particularly Armenia, where there were very polarized views between the um population. Who were very pro Russia and the ones that were pro EU and vigorous debate. Some of the debate that was coming back was, I suspect, reflecting what politicians themselves had said about what will happen if you move away from Russia. What will happen if you go to the EU?You know, Azerbaijan, Turkey, you know, that was very polarizing. But interestingly, um, I wondered if you had any reflections on, um.

The tactics that, that have been used by Russia in some of these places. But, um, interestingly, the first, the first sort of short term report from the OSCE has been that the misinformation on social media, deliberate misinformation didn't. Actually have that much of an impact. Um, now, whether that's because it was particularly aimed at young people who, as you say, had made up their could distinguish between what was, um, uh, just political dialogue and what was real misinformation. But I just wondered whether you had any reflections on that or experience of it, or whether you've ever looked at the reports.
11:24
11:25
11:25
None Portrait Speaker 9
-

Only in the US.
11:25
None Portrait Speaker 4
-

MM.
11:25
11:25
11:26
11:26
None Portrait Speaker 12
-

Please start. Sam.
11:26
11:27
11:28
11:28
11:29
None Portrait Speaker 5
-

Thank you very much indeed. That has given us a lot of food for thought, and we're very grateful for your advice and your evidence. As I said earlier on, if there's anything else you think of afterwards, please write to us. And in the meantime, thank you very much again for your time. And welcome and thank you very much for your time and coming to help us with our very challenging inquiry into national preparedness and resilience. We're very grateful for your time, and we've got you for about an hour.

I think, um, I could. Just need to remind you that this is a public session which is being broadcast live. Um, there will be a transcript that you'll receive in a couple of days time. So if there are any minor inaccuracies or if you spot anything or spot any gaps where you suddenly remember something, you might have said that you didn't, then we would always welcome supplementary evidence in writing if you'd like to do that. And we've obviously got a number of questions to ask you both.

And when you give your first answer, if you could perhaps just begin by introducing yourself very briefly. So we've got that on the record as well. I'll start with the the first question, if I may, um, just setting the scene really, um, could you tell us how far you. Would you estimate that the public has awareness currently of interconnected national and international risks, including obviously the ones relating to communications networks, where your special expertise is important to us to hear about. But the level of awareness of risks in those areas, and perhaps I could start, um, with Miss Newman.

Well, thank.
11:30
None Portrait Speaker 9
-

You very much.
11:30
None Portrait Speaker 14
-

Nicole Newman. I'm the director for Security and resilience policy at Ofcom. So the communications infrastructure underpins our society and economy and our everyday lives. And Ofcom's role as a regulator is to enforce the relevant frameworks and uh. Legal. Frameworks that we have and we monitor industry's compliance against those frameworks. Therefore, Ofcom's engagement is predominantly with the industry, with those organisations that we regulate. And, um, there is limited direct engagement with the general public.

However, there are some examples of where we do engage with the public and where we do communicate the risks that the telecommunications sector faces, such as our Connected Nations report. So that is an annual publication where we set out the risks that the sector faces. Plus, on top of that, what we're doing in that space, we also provide guidance and information for consumers. So when we think about legacy networks like the PSTN, we do set out in our guidance the sorts of questions that consumers should be asking their operators to help prepare them for that transition, and including for scams and fraud.

Practical tips for people to take. So that is information that we make available on our website. The more indirect engagement that we have with the public is through our compliance frameworks. When we consult on our guidance or policy proposals, that information is made available to the public. And in those documents, we do set out the risks that the sector faces. And when there are some critical risks and we communicate with our sector at that point, also, we publish some of that correspondence on our website to raise awareness and to remind the sector of their obligations.

So, for instance, in April, when there was quite a bit of media coverage around mythos and the AI frontier models, we published that letter on our website.
11:32
11:33
11:33
11:33
None Portrait Speaker 15
-

Hello there. Thank you. I'm Professor Lee Miles. I'm a professor of crisis and disaster management at Bournemouth University Disaster Management Centre, which has been around since 2001. I've worked on many aspects of resilience across the world, including in the UK, I'm also associate dean for research, innovation and enterprise at Bournemouth University. In the business in the Business school, Faculty of Business and Law. So I come from a business side. And then the final thing, just to reiterate, I'm also director of a recent project funded by innovate UK, which was on empowering, uh, everyday and household resilience and preparedness for it.

So it was a UK household study and a public study about levels of UK resilience in that space. Um, so those are the three domains that I'm in here for. Um, in answer to the question, I'm going to sort of turn this to look at particularly the, the recipients of this, which is the public. And really just to look at this, you asked me the question, how far is the public aware?I would argue not very far at all would be the would be my immediate response to that one.

And I think it's because when we look at most of the data in terms of awareness, there's low awareness data amongst the public and in particular about households, about particular types of risks. So to give you an example in the study that we did something like 52% of households. Recognised that they were aware of all the hazards that they faced in their households, but something like 25% didn't know had any risk at all. So in that sense, there's an illustration of that. So the first thing is low awareness, which may be part of that argument.

The second is what you might call disconnected priorities. The the messaging around resilience coming from the resilience action plan and the National security strategy and industry strategy and the whole of society. I think what the data shows is actually that households and in particular public often see resilience in a very localised setting, often in their own personal, making it in a personal dimension. So I think that's important. So in terms of the the survey study that we were involved in, something like, uh, for example, to give an example, the highest level of perceived threat were accidents at home and the lowest level at only 4 or 5, 4% was, um, looking at, uh, terrorism and 5% on conflict and war.

So you see this disconnect of priorities. So I think that's an important point. But that so in effect, that leads to limited action. And then my final point, I would say so something like 75% of households that we looked at in the study, for example, took no specific action at all in relation to climate change. And those kind of kind of elements. So there is a communication deficit here in relation to how the sending and receiving matters. That's not to say.

And my final point would be with the Iran war and so forth. There is a rising awareness of what you might call cascading effects. So the public and households have become very much aware that geopolitics leads to higher energy prices, which leads to. Actions on their standards of living. Well, that's a causal economic relationship, which is wound up in resilience rather than necessarily different. So the different interpretation about what's going on in the Ukraine, which is seen as much more distant as a as a threat or dimension as it would be compared to the impacts of that way.

So that's the point I'm trying to make here. Thank you very far.
11:37
11:37
11:38
11:38
11:38
11:38
None Portrait Speaker 15
-

Yeah, I think there's an important point, uh, that you're making, which is very strong. I think just to be very clear about what we're in terms of the first obvious point, I think we have to recognise that households and the public are rational actors. For the most part, they're being perfectly rational in actually deciding what is the threats and hazards for them in their local community. In that dimension, there's always going to be a disconnect between the local localisation of that and national strategy.

That's the case. So there's always going to be a communication, if you like, translation point. I think the important I would say is that basically we need to focus on the concept of, of everyday resilience. In other words, what is, what is what is the notion of everyday resilience?That it has the pertinence that takes national priorities and makes it have resonance in the domestic, in the domestic and household landscape. And usually, I think there's probably four parts to that.

The first is what you might call the four E's, if you like. Let's use the four E's as that. The the first E is what you might call it, enlightened context, which is making it clear in government communications why that context is important for the public and the households to take that domain. Um, that's actually the why, if you like, of why be involved in resilience and what the concepts of resilience is. Point for me is what you might call after that enlightenment, if you might call it, you might call it empowerment of choices.

And that's basically, I think the important thing really there is that is making communications that how that translates into to them in their communities and in their, in their households about the choice that resilience is a choice about what they want to do and what they want to invest in. Is it in flooding?Is it in relation to, uh, investment in their houses and new technology and fire alarms?What is it that is in relation to those kind of elements?And that's important for communication?The third element is what you might call the enabling of actions.

And what I'm talking about here is that you can give people choice, but you also have to facilitate the actions. And that might mean you have to incentivize schemes. So if they do resilience actions, they buy different types of, uh, new technologies. There's an insurance, uh, discount or premium that they might see in terms of that or a government scheme that might help with that. And then the final element, you might call it, which might be the evaluation of the outcomes to show that by doing this, that actually leads to an outcome of better resilience and outcome.

And that if you like, enlightenment, uh. Uh, empowerment, enablement and evaluation, those four E's provide the way in which you can communicate the message.
11:41
11:42
None Portrait Speaker 15
-

It's.
11:42
11:42
11:43
11:43
11:43
None Portrait Speaker 3
-

Indeed.
11:43
11:43
11:44
11:44
None Portrait Speaker 15
-

As a point of context, I was, I was, I was a professor in Sweden for 13 years. So I actually worked in Sweden as part of that. And I worked in the resilience domain during that time on societal resilience aspects. Um, so obviously there's a lot of emphasis on if you like learning from international comparators and we must do that. That's effective. And of course, the Nordic countries and places like Sweden are good places to go to start that.

Uh, I think it's important, important to also, however, recognise that they have very good techniques. But that's also because in terms of the, the overall security and societal framework in which they operate, there has been a total defense strategy, non-alignment neutrality, and a high level of cultural and societal, uh, trust in, um, the workings of government that allows, for example, for particular strategies like my, uh, hard copy pamphlet templates, the famous if war or crisis comes peace. And that was 2018 updated in 2024 to provide basic contextual information to the public about why they should be know about these threats.

Um, but I think the other important point alongside that is we can learn from places like Sweden because they've also provided, if you like, standards, and they've also provided incentivization schemes to allow for, for both households and communities also to develop and move forward with various aspects that everything from the health service provisions, health trusts all the way through to, to local communities. So they're building upon a strength, a foundation or strength of a rather wholesome society, if you want to put it that way. Um, with a very strong, cultural identity around a particular type of policy.

So if you look there, it's often the case that cities and allegiance and trust in government is much higher than it would be in the UK context. Um, so we learn from that perspective, but I think we also have to recognise that the environmental conditions in the UK are very different. Um we are talking about actually a society that is not so wholesome at this point in time.
11:46
None Portrait Speaker 5
-

Um Miss Newman.
11:46
11:46
11:47
None Portrait Speaker 15
-

Just for the committee, I worked a lot in what. I've been a professor working on disaster management, so I've worked a lot, particularly in Sierra Leone, where I've worked a lot, uh, in relation to both before, during and after the Ebola crisis. In 20 1416. And we're very closely. This in many projects of that nature. The important thing to recognize, if you look to the African examples is that when we build resilience, if you like, or we're talking about using examples from other countries, we may go often to European countries where we might be investing in high technology solutions, you know, so we want to make sure that we have redundancy situations for cyber, for communities so they can and they have a lot of, uh, technological advantages in terms of satellite phones or satellite redundancy situations, mobile networks that can call upon or masks if they're if they're damaged.

You don't have that in the African context. I think what the African context shows is that there's also a very strong reliance on low tech solutions. And actually, as we become more digitalized, then the question of redundancy becomes really quite challenging, where we would have used analog phones, for example. And if digital breakdown in the UK, we may be moving away from not having an analog, you know, telecommunication system as it once was. So that in itself creates challenges. So often you tend to find that actually the strength of there is having local communities, which might be using, for example, having, uh, halo systems, for example, having communication agreements about how to do in the local setting.

So they're, they're often low tech solutions. And as part of building the resilience, we should not forget that we don't just need to go high, but we also need to redundancy, which is lower, particularly in parts of our communities, which are rural and maybe outside the the communication networks.
11:49
11:49
11:50
None Portrait Speaker 14
-

Thank you. So I would like to break it down both from the planning and preparedness side. What we currently have, and then restoring the service. So when we think about the planning and preparation and the work that Ofcom does in this space, it does refer back to the resilience guidance we set for the operators. And in there we do say that avoid single points of failure. So build your infrastructure, your architecture in a way that there is an aspect of redundancy.

Recognising the challenges with that. As part of that, having business continuity plans, having disaster recovery plans. But within those plans, being very clear what those processes are, because many times the processes can be there, but they're not understood and they're not tested. So we do make clear that we expect the operators to do that. We also expect that there is power resilience. So where are the key sites that the operators should have the power backup to build on that for government in the event of the national emergency situation?We have the emergency services network.

So what Home Office is investing in across the UK?And they're looking to further hardening that network. There are also the satellite communication um services that are available to the UK government in the event of a national emergency. So the way professor Miles was referring to that our military have access to that with regards to what is available now when there is an incident and what the telecom operators can already do, they can deploy mobile cell sites. So where there is either a specific incident or an outage or a damage to a cable subsea cable, they can go and deploy for that area.

Um, a interim mobile coverage solution. They also have generators on wheels, so they can go and deploy generators in the areas that need it. One of the things that we do expect the operators to also do alongside that is be transparent with the services that they offer, the processes that they take. So many operators publish this on their website. So for example, BT does publish a very comprehensive set of steps that they do take so that there is an awareness of, in the event of an emergency, what they do.

There is action that operators can also take. So currently, in the event of an emergency, operators can roam onto different networks to make an emergency call. There are also satellite communication offerings. Now with uh. Technology evolution that does help. We're getting a layer of resilience coming in. So direct to device capability is there. We're also seeing in certain communities like the Shetland Islands, they have invested in satellite terminals that is available to the community.

So again, when we talk about specific solutions available in certain communities, that is a great example where those localised opportunities need to be taken into account. What we have seen though, is we can plan and prepare. We can have the solutions that we currently have, but to restore the power very swiftly is also very important. So Ofcom has been working very closely with the energy sector and industry to establish how can communication improve when there is an incident?How can the telecommunication sector and the energy sector engineers communicate and coordinate on the ground to ensure the services are restored very swiftly?That work still continues, but we are taking learnings from what happened in Spain and Portugal because that is a clear example that it's not when an incident like that will happen.

Um, and and if so, we are planning already and looking at those scenarios, but it's very important. We don't work just within our sector. It's a cross-sectoral challenge. And there's interdependency with the energy sector.
11:54
11:55
11:55
None Portrait Speaker 5
-

Mubarak.
11:55
None Portrait Speaker 14
-

Yes.
11:55
None Portrait Speaker 10
-

Um.
11:55
11:56
11:57
11:57
None Portrait Speaker 9
-

And we.
11:57
11:57
11:57
None Portrait Speaker 15
-

If I may?Um, and it kind of alludes partly to the previous question, and that's about international comparators here. I fully support. Nyali saying, but I think there's two important points that we need to think in terms of evidencing. The first is about how long the outage would be in terms of that factor. So there's a very good examples in the Caribbean in relation to hurricanes, which have knocked out complete communications networks for two weeks at a time. And in the case of Cuba, of course, after Irma and Maria, with a power outage for 80% of the island, was for eight months.

So one would have to talk about to what extent there's a resourcing question, and it goes down to prioritizing and resourcing of those two elements. The final element in that relates back to is also about the expectations of the public. In my case, the research on households about their expectations for how long it is acceptable to be without communications of mobile phone or internet, because in many people, many people, parts of SMEs through to all of our business communities through to local communities and households, the internet is not an option.

It is actually a way of life. And it's actually part of what the essential service. So we need to be very clear about treating the length of an essential service as being something that will have a management of an expectation for both nationally and also for our service providers. And then the final point, of course, is to reiterate the point, which is, of course, in the in the resilience world, the vast majority are often our recovery and our response is delivered by private sector providers.

So it's often the case that 80% of recovery, for example, is provided by private sector providers. So actually the arrangements between them over not just a short term response phase, but over a longer term recovery phase, is actually quite important because there are costs which have to be met commercially. If those services are going to continue to be provided beyond Emma's, those are some of the issues that we need to think about.
11:59
11:59
11:59
None Portrait Speaker 15
-

Well, I mean, not surprisingly, I'm going to say it's absolutely essential that the education sector plays a fundamental role. But I'm not just saying that because if you like, I'm in that background, but also because it is essential strategically and also for implementation at all levels. Uh, if we look, for example, at the school levels, then of course there's lots of initiatives and work on smart schools in which we, the idea is to build in, uh, you know, um, resilience, understanding is resilience, basic resilience, response ideas, how to do things into the curriculum, uh, at the school level.

And that's very common in places like the Caribbean where the, where there is a continual threat. And as we move to many of our threats and hazards, becoming business as usual rather than an extraordinary matters, then it becomes part of that citizenship element of training. But I think there's also a very, very important point behind that in that education is also providing not just good citizens, if you like, and our expectations of the state, but it's also influences that we're generating the resilience managers, the of the future.

And they often have a very important impact at home in the households where actually the resilience influencers are in that are in that teenage group. So I think we need to understand that from the school perspective, particularly the 14 to 25 year old, if I may use that phrase, which is beyond the the force school perspective, these are the future volunteers on which resilience would be based. If we talk about that moving to the level of the phase, I would argue, actually, they've got a very substantial widening access role.

You know, and what I mean by that is not just are they those Fe colleges and Fe provision providing key subjects like geography, where actually things like hurricanes, things like earthquakes, things like that are actually stored and taught as part of the normal curriculum. But think about the access and competence courses that are provided from boot camps to widening access courses. And there's a very strong market, if you like, particularly I think amongst the, let's say, the 55 to 70 generation who are who are interested about providing those resilience courses.

It might also be the place where you find first aid courses, where you find basic issues to do with training on competencies and skills. Um, so if I use that analogy, the school element is often where you might enlighten the contexts, the Fe sector, if you like, is where you might empower the choices for people about what they do and what they know. But of course, from the university level, I would argue it's absolutely essential because our roles are in providing research about how resilience and how it's evaluated in that piece.

It's about building the knowledge and thinking. But I'm also a professor at a disaster management centre who trains emergency planners across the world. And the universities have a fundamental role in training emergency planners in having resilience degrees, in providing the context and cohorts of our specialist experts of of the future. And I think that should be important. And then the final point is the impact on the resilience agendas through that research, working as I do with companies, SMEs, through to large multinationals on resilience projects where the public private partnerships are critical in providing knowledge with with commercial opportunities to move the to move the competencies, the skills and the and the toolkits and markets for the future, because I think it's important to recognise that resilience is a market and not just an education aspect to it, and therefore the societal impact role is large on the part of universities.
12:03
12:04
None Portrait Speaker 14
-

To add on education.
12:04
12:04
12:04
None Portrait Speaker 14
-

So I would break this down between the telecommunications sector and the digital infrastructure sector. For us, the internet infrastructure, for the reason being, there's two different legal frameworks that we work to, and there's different levels of expectations that we place on the sectors for the telecoms sector. And we are proud of the Telecoms Security Act in the UK, because it's a key, comprehensive framework that we have in place. It was introduced in 2021. It came about at the back of a risk assessment and a threat assessment carried out by the National Cyber Security Centre.

So a comprehensive exercise was carried out across the telecoms space by the UK's technical authority to establish what are the threats the UK faces in that sector, and therefore, what are the measures and steps that need to be implemented. And that was then baked into a legal framework, and Ofcom has a very key role in that space where we monitor industry compliance and we report to the Secretary of State in DC as to how the sector is performing. One thing that is important with that framework is it is proportionate, so it is not applicable to everybody with that code of practice is concerned because there are large communication providers with turnovers of greater than £1 billion, and you've got the much smaller operators as well.

So what the UK government did is they segmented the market and said the code of practice would be applicable to the large and medium sized operators, because the risks that they face is much more larger. And therefore the measures that they need to do and the timetable that they need to follow. So that framework is already there. We've been monitoring that. What we are observing with those operators is there is that level of commitment to investing in the. Requirements that they have to follow.

It is a journey. The risk landscape does evolve and change. And what we have to ensure is any framework that we put in place needs to move with the threat landscape. So the Code of Practice was consulted on by government recently and will be published imminently, as well as an update. We do set out in a transparent way as to how we will monitor industry compliance, how we will exercise our responsibilities in that area. Plus, on top of that, we have our own resilience guidance that I mentioned early.

But there's also high risk vendors. So the UK government now has powers to deal with high risk vendors. They have designated a vendor. But in that space, Ofcom does not have a very big role. The enforcement sits with, uh, DSS. But we monitor how the sector is doing, and we provide that report to government. And then they carry out the necessary enforcement steps. When we look at the critical national infrastructure across the UK, we have the network and Information Systems regulations, and that is currently being strengthened.

So coming to the point that, you know, where is cyber security and how are we preparing ourselves for the evolving risk landscape and how technology is evolving?And not only thinking about the. Hardening of the frameworks within each sector, but across the sector. So we do welcome the Cyber Security and Resilience Bill. It's making itself currently through Parliament. And Ofcom is responsible for the digital infrastructure sector, but also for. We're expecting data centres to come in.

And that is going to be a key part of that value chain, because when we think about communications, we think about subsea cables, we think about satellite communications. Your terrestrial networks, and we also think about now data centres as they come in. What is important when we think about cyber security is there needs to be a baseline as well. A baseline expectation. And that's one of the things that's being proposed in the cyber bill that all the sectors need to work to.

An aspect of baseline, and then the sectors can come and implement something that's specific to their sector. We do work very closely with other regulators in, you know, the energy sector. So with Ofgem we work with the Information Commissioner's Office. We work with the CAA in the Aviation Authority. So nationally we are working across the board. But what we also do is work with international partners. So late last year, we convened the Five Eyes, where we are sharing our learnings, but we are also seeing what they're doing.

I was involved earlier this year in international cyber regulation conversations at Wilton Park. Again, that's a great learning opportunity for us. We can't operate in a silo, so we need to learn and hear what other nations are doing, what our partner partners are doing in other countries. And also we work very closely with government because ultimately it is a collective challenge that we need to work on, and it's a team sport, so we need to make sure we're evolving and moving over time.
12:09
12:09
12:11
12:11
None Portrait Speaker 11
-

It's the oversight.
12:11
None Portrait Speaker 14
-

It's the oversight.
12:11
None Portrait Speaker 11
-

In the legislation.
12:11
None Portrait Speaker 6
-

It's the.
12:11
12:12
12:13
12:13
12:14
12:14
12:15
12:16
12:16
None Portrait Speaker 7
-

Probably probably two points and it might be the next step after this. Obviously from my role as a professor and where I look at these kind of things, which is obviously the bill is encouraging and having baseline expectations and creating sector standards, which are very important and intersector standards, which I think is with the implications of what is being talked about there. But I think there's a the important thing also to recognise is, is basically that those codes of practices that follow need to be agile enough to take into account that the sector itself is moving at great pace, particularly around AI and other domains.

You know, I was struck, for example, by a recent data, for example, that shows that most data shows that 60 to 70% of SMEs in the UK have been experiencing a cyber attack. But I looked at the IBM Threat Intelligence report, and there's a massive increase, something like 44% of AI accelerated attacks or attacks that don't even involve passwords, where the AI. Systems or the cyber security is not just about defence. It's actually about actually about the maintenance. So the codes of practice are really important in having that agility and flexibility.

From my perspective in in the Bournemouth University Disaster Management Centre, we train around those codes of practice and of course, build simulations and exercises to be able to to test if you like, the, the, the adherence to plans and the adherence to workarounds in this agile space. And I think in answer to the question which was put forward, which was about the strategic which was the value for senior policy makers, there's a big piece of work, not just about how we train or exercise the bill and the implications of the bill, but also educating our senior management teams in the strategic value of investment beyond the regulation.

And that, I think, is very important.
12:17
12:18
12:19
12:19
12:20
12:20
12:20
12:21
12:22
None Portrait Speaker 12
-

Thank you.
12:22
12:23
12:23
12:23
None Portrait Speaker 10
-

Sure.
12:23
12:24
None Portrait Speaker 12
-

You smiles.
12:24
12:25
This debate has concluded
Return to start of debate - Return to top of page