For businesses and governments (especially in the defence & security sectors), crisis management is usually thought of operationally: Was the threat contained? Was the asset protected? Was the mission accomplished?
These questions remain the essential core, but they aren’t sufficient today. Public confidence, national credibility, and deterrent power matter almost as much as operational outcomes. Having these three things versus not having them can be critical to whether you successfully prevent future crises. What this means is that an organisation can successfully prevent a crisis and still emerge looking weaker than before.
RAF Fairford: When a Security Incident Becomes a Crisis of Confidence
In the UK, we recently saw this play out at RAF Fairford. Suspected terrorists were arrested for allegedly planning terrorist activities after being found near the Gloucestershire airbase. The suspected activity was disrupted, and the individuals were apprehended. On a narrow operational assessment, that might suggest the system worked. But the public narrative quickly spiralled. Questions about the suspects’ release on bail fuelled anger and confusion. Concerns emerged about the security of strategically important military installations when it seemed they may only have been caught because of a vigilant local’s report.
Others reacted in the opposite direction, ridiculing the “major incident” treatment of the event and suggestions of foreign-backed terrorism when explosive devices weren’t believed to be found. The United States subsequently removed high-value aircraft from the base, meaning that military capability had been removed from the UK – even though no attack actually occurred.
So, in summary, this became a story not about a security threat being stopped, but about whether the UK could protect a critical military site and manage the consequences.
Winning the Strategic Battle Without an Attack
This highlights an uncomfortable truth: that the UK’s enemies can achieve strategic objectives just by sowing doubt, without perpetrating an actual attack. Many security practitioners have questioned whether the incident was designed to expose weakness, rather than to actually perpetrate an attack.
As evidence, they point to careful staging: those apprehended caught with things that would only be be considered as a low-level crime if not part of a terror plot, without explosives, etc. basically, a very good test of organisational cohesion and response, but maybe not a very well-prepared actual attack. If an operation was intended to generate doubt, undermine confidence in British security and expose apparent institutional weakness, then the resulting publicity could represent a form of success, even if the perpetrators never achieved anything more tangible.
That is a hypothesis, not an established account of the intentions. But it illustrates a serious strategic problem: the success of a hostile operation cannot always be judged by what happens at the target. It must also be judged by what happens in the minds of the audience. This time, however, the UK response did not join up communications between parts of its law enforcement and justice apparatus, the public, and its international allies.
Many people were left thinking not “I’m really worried about the increasing frequency of potential foreign attacks here at home” but “what a strange response…and how seriously should I even take these foreign threats I’m hearing about?”. That doubt helps any adversary who would like to attack the UK, or prevent it from acting, in the future.
The Same Risks Apply to Business
For businesses, the principle is much the same. A company that manages sensitive customer data and faces a cyber incident may contain the intrusion successfully, yet lose customer confidence through contradictory statements or unexplained delays.
A manufacturer may prevent a safety incident from escalating, but still face a reputational crisis if its communications suggest that nobody is in control. Businesses that handle our national infrastructure, our financial data, our civilian communications are increasingly part of our fundamental national and economic security.
Why Crisis Communications Cannot Operate in Silos
We hear about crisis communications these days than ever before. But it remains the case that many businesses plan their operational response to incidents and their communications responses, in separate silos. This should change. Stakeholders do not see the difficult decisions made behind closed doors. Public and customer audiences see panicked, drip-fed information via social media first, usually from those who’ve seen something wrong rather than from sources that could give them the full picture. And they draw conclusions about competence: often negative ones.
Our “house view” is that businesses and governments give themselves the best fighting chance in the current fast-paced media environment with preparation before an incident occurs. There are a few principles to this that we think broadly hold true and help productive crisis planning:
-
Anticipate the questions that matter to different audiences. The public is concerned about local safety. Allies are concerned about force protection. Customers want assurance about continuing services from a business. Investors care about financial risk. A single statement or channel is rarely going to address all these audiences.
-
Communications should explain decisions, not just announce them. There are valid (and explainable!) reasons why some information may need to be withheld, but unexplained silence breeds speculation. And that speculation is usually unhelpful and hard to dislodge once it takes root.
-
Establish a coherent timeline from the start: what happened, what’s ongoing, and what comes next. Even when some information must be withheld, understand where that information will fit into the “full picture” narrative and timeline, and try to add to the story, rather than placing yourself in a position where you must change it. That means coordinating operational communications teams from the outset, not inviting the communications team into the room once things are already publicly off the rails.
In summary, a crisis can have several simultaneous battlegrounds. The immediate threat may be physical or financial, but the secondary battle is over trust. In some circumstances, that second battle may be precisely where the greatest risk lies.
