Nation & World

Bridging troubled waters

long read

Expert on crisis management sees key lessons in Christie, Target responses

In politics and business, the best-laid plans can go astray instantly when mismanaged trouble spirals into full-blown crisis.

A current case in point: N.J. Gov. Chris Christie, after denying that the September shuttering of traffic lanes on the George Washington Bridge in Fort Lee was orchestrated by his office as political retribution, had to confront damaging reports last week that the closures were ordered by a top aide, and were known by others. The revelations came with the release of emails from high-level Christie advisers and appointees at the Port Authority of New York and New Jersey.

During a Jan. 9 news conference, Christie apologized but denied knowing of or being involved in the traffic scheme. Christie said he had severed ties with his campaign manager and deputy chief of staff, who were implicated in the emails. Two Port Authority executives, who also knew of and appear to have assisted in the lane closures, abruptly resigned last month.

In another crisis-management case in the news, the massive Minneapolis-based retailer Target announced last month that hackers had stolen credit and debit card numbers from 40 million customers between Nov. 27 and Dec. 15. Since then, the company has twice revised that figure upward, acknowledging now that financial and personal data, such as phone numbers and addresses, from as many as 110 million customers were taken during the security breach.

Herman B. “Dutch” Leonard, the George F. Baker, Jr. Professor of Public Sector Management at Harvard Kennedy School and the Eliot I. Snider and Family Professor of Business Administration at Harvard Business School, studies crisis management and leadership. He spoke with the Gazette about the challenges facing Christie and Target and their performances to date.

GAZETTE: How would you rate Gov. Christie’s handling of the bridge scandal and Target’s handling of the data breach thus far?

LEONARD: In both cases, I would say so far as we know, they’ve done pretty well. The reason I would say “so far as we know” is that how well they are doing depends on facts which we can’t be certain of at this point. If all of what Gov. Christie knows has been revealed, then I think he’s done a very good job of recognizing that this was a very substantial problem, getting on top of it, and trying to figure out a way to manage it truthfully and forthrightly and successfully. If it turns out subsequently that he knew a lot more about this or he could easily have found out and just basically wasn’t paying attention, then that’s an entirely different matter. If all of this story is as Gov. Christie presents it, then I think his press conference was quite remarkable and will be a model for how to take blame and how to model the acceptance of some bad event having happened even while you’re saying that you personally didn’t know more about it.

It’s very hard to tell often, when you had a cyber attack, just how widespread the damage was and how many people’s information might have been breached, so if Target gave its best good-faith estimates, then sometimes it just turns out worse than you thought. But you want to be very careful when you revise it once that you’re not going to have to revise it again.

I think the fundamental driving force in how well these events go is how well they are being handled from a substantive perspective. The critical question to ask is: How well have these officials at Target and in Gov. Christie’s office — and the governor himself — gotten on top of the actual substantive event? If, in hindsight, we say, “That was about as good a job as they reasonably could have done,” then I think they’ve done a good job both from a substantive perspective and from a process or public-relations perspective.

Good risk management doesn’t begin when the event has already broken on you. You have to ask the question: “How did the event happen, and could things have been done ahead of time that would have changed it?” That being said, once we look at the prevention and it hasn’t been prevented, then you can and need to ask, “So how are they handling it, given that it took place?” How accurate was Target’s information at the beginning, and how effectively did they assess how accurate it was? It’s one thing not to know exactly what the number is, it’s another thing to think you know when you don’t and to behave as if you are certain when there are indications that you shouldn’t be certain.

GAZETTE: By laying out a very specific timeline of what he knew when, did Christie paint himself into a corner?

LEONARD: There’s no problem with being specific as long as you’re right. It’s one thing to be confused in your memory about “was that a Wednesday or a Thursday?” It’s another, though, to lay out a timeline, and then somebody says, “There was an earlier briefing in which it was said to the governor that there might be some substance to this.” There’s no problem of saying what happened as long as you describe it to the best of your ability, and you leave yourself appropriate hedges for where your memory might be faulty.

GAZETTE: With probes by federal and state authorities into the bridge matter under way, and another into the possible misuse of Hurricane Sandy relief funds, the full scope of Christie’s problems is still unclear. How should he manage a multidimensional crisis with a number of actors moving forward?

LEONARD: The question is: Are there just two [issues being investigated], or is every other allegation that’s ever been made going to turn into a full-blown investigation too? If it looks like one or another of these is mushrooming, then that would invite all kinds of other clamor for other investigations. In an event like this, the people who are watching it have two different scripts in their hands about who Chris Christie really is. There’s the good-guy version and the not-so-good-guy version. And obviously, depending on who you are, you favor one of these versus another. The question is how the unfolding of the facts plays against those different narratives.

GAZETTE: Messaging, optics, tone, controlling the narrative — what’s the most important to master as a crisis is unfolding?

LEONARD: Again, substance first, then message and tone. And he did the substance first: He fired his aides. Then, the key elements flow from the confidence of the governor himself. In his press conference, he looked confident that he was on top of this situation, that he now knew what the issues were, that he had dealt with the issues, that he’s not vulnerable from having had been exposed to this before, or been implicit or complicit in it. He looked confident that there isn’t some huge iceberg under the water here that we’re going to discover. I think to the extent to which he is seen as confident, seen as taking the hit but telling the truth, then I think the story doesn’t go on very much longer unless new, damaging facts emerge.

GAZETTE: Christie did, however, express brash confidence early on, when first questioned, that the lane closures were not engineered to cause political harm to the mayor of Fort Lee.

LEONARD: Doing that is a bad strategy if you don’t think it’s true. It makes me feel like he really didn’t have any information at that point because ridiculing it is basically an invitation for people to dig further into it. You wouldn’t do that if you thought you were vulnerable. That suggests he had no real inkling that his aides were involved. It really is hard to imagine people deliberately setting up something that’s going to tie up traffic and tie up schoolchildren on school buses for hours. It is a startling idea, and perhaps the governor can be forgiven, at least at the beginning, for not giving much credence to such an outlandish possibility.

GAZETTE: Both Christie and Target seemed to have been caught unprepared. Target took weeks to determine how the breach was conducted and the true number of affected customers. In Christie’s case, he trumpeted his lack of awareness, both about the actions of his staffers and appointees and the Jan. 8 release of damaging emails, as proof of his innocence. Is not knowing, or professing to not know what’s going on, the basis of an effective strategy?

LEONARD: First of all, that strategy will only work if it’s true — if he really didn’t know and he hasn’t encouraged his aides to play dirty tricks on opponents. Because if he has, there will be enough intense scrutiny here that facts about that will be found out. Can that strategy work? It depends on how close to his office the actual issue is. Nothing would have suggested that he should be involved in finding out about what’s going on with a traffic tie-up in Fort Lee. It doesn’t seem like that is a kind of issue that would naturally attract his attention, or that he would have any involvement with. So in that sense, it is plausible that this could be other people acting on their own sense of empowerment, that it does have nothing to do with him, and that he can then push it away by saying: “I had nothing to do with this, and there’s no reason why it would have called upon me to be involved.”

Neither Target nor Gov. Christie seems unprepared to me. I think Christie handled this basically according to a script for how you handle breaking events. In that sense, he was ready. It’s always possible you can be blindsided by an issue. Being unprepared means to me that you don’t know what to do when that happens. I think he was very well prepared to deal with that. What he wasn’t was aware earlier of this event. So you have to judge, should he have been? Is there reasonable cause for suspicion or further investigation on his part that would have led a reasonable person to have found out more earlier? That’s still an open question.

I think that Target should have been more careful not to say things it could not be certain of. The nature of the kind of event that they had makes it very difficult to know what the extent of it is. So I’m not surprised they didn’t initially know and that it’s taking them a long time to figure out. I’m a little surprised they weren’t more circumspect at the outset about the uncertainty of their knowledge about that, precisely because it’s so difficult to be certain of how big a breach is. The flip side of that is, they have to maintain some degree of confidence among their customers. I think the ways they tried to do that, while maybe not perfectly designed, made a good deal of sense.

GAZETTE: Does a political crisis differ from a corporate crisis in terms of strategy and management?

LEONARD: There are two different things that you’re managing. One is the actual realities. You can’t get very far away from the realities and sustain that. So if you’re not handling them well, that will eventually be obvious to everybody. Even if you are managing them well, there’s a separate set of issues about how it is being perceived to be managed, and those perceptions are not necessarily very directly hooked to the realities. A good example of that is the BP oil spill. Both the government and BP, to a certain extent, did a better job than they were given credit for. But the PR side was miserable. If you think about the amount of oil that went into the water and the limited amount of damage that was ultimately done on the beaches of the Gulf Coast, the perceptions were pretty far away from the underlying realities. I think BP and the federal government lost control of that story, lost influence in that story, and that’s a situation where even doing a good substantive job wasn’t by itself enough.

GAZETTE: How does one accurately measure whether they’ve successfully weathered the storm?

LEONARD: Every one of these events is different, and so it’s very hard to specify. If something bad happened, we shouldn’t assume that you can come out of that without any damage at all. So the question is really: Relative to what a good performance would have looked like, how did they actually do? And that’s a very hard standard to set. I tend to look at it procedurally and to say: Given the resources available, how effectively were people able to mobilize, and did they do what you reasonably could have hoped for? As a Wall Street analyst, you would look at the change in the value of the company. What happened to its market capitalization? What happened to its revenues and earnings going forward as a result of this event? But the problem is, compared to what? Obviously, what you’d like to do is to compare it to a good performance. You don’t want to compare implicitly to “there never was an event.” I think you have to say, once that unexpected event breaks on you, how effective, how nimble were people at being able to keep the damage from spiraling?

GAZETTE: What are the best practices in preparing for, handling, and dealing with the aftermath of a crisis?

LEONARD: One thing you can do is try to prevent them. A second thing you can do is to be prepared to respond to them. A third thing you can do is to respond when they actually happen. The fourth thing you can do is to recover after you’re finished with your response. The question of how good a risk-management job a company is doing is how well it has distributed its time and attention over those four different aspects of managing its risks. How well is it looking after them ahead of time and preventing those that it can foresee and do something about? How much has it got a response process that allows it to be nimble and adaptive when things happen? How effectively did it use that process once the thing broke on it? And how well-configured was it, and how rapidly did it mobilize itself to recover swiftly in the aftermath?

One of the frameworks that we teach both to businesses and government organizations is something called the “incident management system,” which is a way of organizing the people who are trying to manage different elements of an event. Working with places like Harvard University, we urge them to use the incident management system for things like Move-In Day. It’s not a crisis, it’s not an emergency, it’s just a major organizational activity that has to take place. But if you practice [using] the system in that circumstance, then when you do have the [Boston] Marathon bombing, and you have a police chase that runs past your campus, and you have an order to lock down, you have a structure that you can dial up to manage and communicate across the Schools, and be able to mobilize the things you need to do in order to keep a University that’s in lockdown safe over the course of a day. We urge people to practice in every way they reasonably can the kinds of structures that are useful for prevention and for response and for recovery.

The interview has been edited for length and clarity.