House of Commons - Scientific advice and evidence in emergencies

Scientific advice and evidence in emergencies - Science and Technology Committee Contents

4 National Risk Assessment

46. What is risk? The Royal Society of Chemistry distinguished between hazards and risks and provided a simple definition, which we adopted for this inquiry. It stated that:

Hazard is an intrinsic property of a substance or situation. Risk differs from hazard, as it involves a consideration of the probability or likelihood of a consequence occurring as well as what the consequence might be.[40]

47. While the Cabinet Office looks after risk assessment in the context of emergencies, it is the Treasury that aims to improve government's capability to handle risk and uncertainty more widely.[41] The Treasury provides the following definition of risk which makes it clear that risk is not seen as inherently good or bad. Rather, it is about uncertainty:

Risk is most commonly held to mean "hazard" and something to be avoided. But it has another face—that of opportunity. Improving public services requires innovation—seizing new opportunities and managing the risks involved. In this context risk is defined as uncertainty of outcome, whether positive opportunity or negative threat, of actions and events. It is the combination of likelihood and impact, including perceived importance.[42]

48. The key process by which risks to the UK are evaluated is the classified National Risk Assessment (NRA), led by the Cabinet Office. This is a comprehensive, classified assessment of the most significant emergencies (malicious and non-malicious) that the UK could face over the next five years. Most types of risk are reviewed every year, but some are reviewed at longer intervals. There are three stages to the assessment: the identification of hazards; assessment of the risks and their impacts; and comparison of the risks.[43] We examine these stages later in this chapter.

49. Since 2008, an unclassified version of the National Risk Assessment, the National Risk Register (NRR) has been produced to assist individuals and communities interested in improving their own preparedness for emergencies. Unlike the NRA, the NRR is publicly available and provides an indication of the types of risks the UK faces and an indication of what the Government is doing to prepare for them.[44]

The role of the GCSA

50. We would expect the NRA to be strongly informed by scientific evidence in all three stages of assessment. It is easy to see why this should be so: scientists and engineers are involved in the prediction of terrestrial and solar weather, the design of cyber systems, modelling disease outbreak patterns and understanding volcanic activity. Indeed there are few emergency risks that do not have a scientific dimension. The Government appeared to confirm this view in its written submission:

The National Risk Assessment and Register, and the crisis management response, are all underpinned by scientific advice coordinated by the Government Office for Science (GO-Science), under the Government Chief Scientific Adviser. [This includes advice on social sciences, engineering and technology.][45]

The Government Office for Science website states:

Contingency planning includes monitoring and assessing threats/hazards (e.g. terrorism, pandemic disease), planning to mitigate the risk, carrying out research and evaluation to ensure that the plans are suitably robust, and exercising and training to ensure implementation of the plans. The work of the GCSA and GO-Science is to ensure that all these stages are underpinned across Government by strong science—whether research or advice.[46]

51. We wanted more detail on how GO Science and the GCSA underpinned the NRA and NRR. However, when Sir John Beddington, the GCSA, appeared before us, the following exchange occurred:

Stephen Metcalfe: [...] are you saying that you hadn't, until the volcanic ash incident, been involved in setting up the national risk assessments?

Sir John Beddington: No, not directly.

Stephen Metcalfe: You weren't having an input into that at all?

Sir John Beddington: I had not had it initially, no.

Stephen Metcalfe: Who would now make the final decision? You now having become involved and made recommendations, who is going to make the final decision about what makes it on to the national risk assessment?

Sir John Beddington: I really don't know, I'm afraid, Mr Metcalfe. The discussions are at the Secretariat level. If there was any debate about that issue, quite how that would be resolved I couldn't say at the moment [...] It may be that the National Security Council would make the final decision, and I input into that through the Senior Officials Group.[47]

52. When asked whether he was surprised that he did not know who made the final decisions about the NRA, Sir John said "yes" and continued:

I suppose what I am thinking [...] is that by and large you would expect a consensus to go forward, so it would be a decision by them with a consensus coming in from the scientific advice. In the event of some disagreement about what might constitute a risk, I would obviously have to get involved, although I have not encountered such an event.[48]

The thing is that the Cabinet Office own the National Risk Register and the National Risk Assessment. It is their responsibility, so I should imagine that Sir Gus O'Donnell would be the person who ultimately might have the final say, but obviously Ministers would need to endorse that.[49]

53. We pushed this issue with Rt Hon Baroness Neville-Jones, Minister for Security, who told us:

The Cabinet Office takes charge of the regular updating of the National Risk Assessment and that is done by a team in the Civil Contingencies Secretariat, who have a structured relationship with the scientific advice available to Government through the Government Office for Science and particularly Sir John Beddington. Scientific advice and, indeed, help in the definition of what constitutes the risk, particularly both likelihood and impact, is fed in from the very start. I wouldn't say that there is any stage at which scientific advice is not available or, indeed, not actively involved in the process of consideration.[50]

When pressed further on who provides scientific advice to the NRA, the Minister told us that "there are a whole series of committees [that] exist in relation to different sorts of advice that the Government need".[51]

54. We are surprised and concerned that the Government Chief Scientific Adviser (GCSA) had no direct involvement with the National Risk Assessment (NRA) process until recently. In addition, we are concerned that the GCSA's oral evidence appears to be at odds with the Government on an issue that is a matter of fact—either GO Science and the GCSA are involved with the NRA process or they are not. We consider that science should be at the heart of the NRA process and ask the Government and the GCSA to clarify this matter.

55. Another situation illustrated the GCSA's detachment from the NRA. During the course of our inquiry, severe winter weather in the form of heavy snow and ice was causing disruption across the UK, particularly to road, rail and air transport. In this respect, we noted similarities to the disruption to aviation caused by volcanic ash during April 2010. On 19 December 2010, the Transport Secretary, Rt Hon Philip Hammond MP, announced that the Government had asked the Government Chief Scientific Adviser "to give us a report on future weather planning assumptions", that is, whether the Government should be planning for more severe winters in future.[52] Severe weather is already included as a risk on the National Risk Register. We are disappointed that it appears, from the Secretary of State for Transport's comments, that the GCSA had little or no input to the risk assessments that must have taken place on severe weather.

56. The National Risk Assessment should be based on the best available evidence from a range of relevant sources. The Cabinet Office may receive advice from committees, presumably including scientific advisory committees, but this is not enough. The Government Office for Science, working with the Cabinet Office, should be involved at all stages in the NRA. We recommend that the GCSA should be formally involved in the NRA process at a high level. The NRA should not be signed off until the GCSA is satisfied that all risks requiring scientific input and judgements have been properly considered.

GO SCIENCE AND THE CABINET OFFICE

57. The need for a close relationship between GO Science, headed by the GCSA, and the Cabinet Office is fundamentally important in ensuring risk assessment and planning is underpinned by the best available scientific evidence. Our predecessor Science and Technology Committees evaluated the benefits of co-locating GO Science within the Cabinet Office and recommended co-location on several occasions. For example, the 2006 report Scientific Advice, Risk and Evidence-Based Policy-Making considered that "the Cabinet Office [...] would in many respects be a natural location for the GCSA, reflecting his role as CSA to the Cabinet and Prime Minister, his cross-departmental remit and his independence". Having considered the "strong arguments for and against" relocation the Committee stated "on balance, we recommend the relocation of the GCSA's office to the Cabinet Office".[53] More recently, the 2009 report Engineering: turning ideas into reality recommended that the GCSA should be renamed the Government Chief Scientific and Engineering Adviser (GCSEA) and should head up the Government Office for Science and Engineering, which should be placed in the Cabinet Office.[54] The Government's responses to both recommendations stated that "the location and responsibilities of Ministerial and GCSA posts are a matter for the Prime Minister and will be kept under review".[55]

58. Considering the relationship between the Cabinet Office and GO Science afresh while looking at emergencies led us to consider the location of GO Science too. When we asked the GCSA for his views on the matter, he responded:

there are advantages and disadvantages. In particular, the major advantage is the close proximity of the Government Office for Science with both the Science Minister and also Adrian Smith's [the Director General for Knowledge and Innovation at the Department for Business, Innovation and Skills] team [...] We are co-located. My office is about 50 metres from Adrian Smith's, and I think that is a very substantial advantage of getting joined-up Government. In terms of access to the Cabinet Office, my reporting line is to Sir Gus O'Donnell and we do link in on a very regular basis with his office, the Civil Contingencies Secretariat and so on. On balance, I would say the location, in proximity with Adrian and his team and David Willetts, probably outweighs the advantages of contiguity with the Cabinet Office.[56]

59. The view of Rt Hon David Willetts MP, Minister for Universities and Science, was that:

[GO Science] has been located in various places over the years. I don't think there is any ideal location. All I can say is that we are very comfortable with the current arrangement. The Prime Minister took a very clear view when the coalition Government came into office that he wasn't going to divert his energies into reorganising Whitehall.[57]

60. The argument for co-location goes both ways: closer proximity to the Cabinet Office and Prime Minister, the key recipients of the GCSA's advice, could provide substantial advantages too. The Cabinet Office has "an overarching purpose of making government work better", supporting the Prime Minister and the Cabinet and "helping to ensure effective development, coordination and implementation of policy and operations across all government departments".[58] This complements the role of the GCSA and GO Science, which is to ensure that all levels of government, including the Prime Minister and Cabinet, receive the best scientific advice possible, and to enable Departments across government to create policies that are supported by strong evidence.[59] Both the Cabinet Office and GO Science have cross-departmental remits and a shared aim of helping departments improve their policy processes. There are compelling arguments for bringing the two together.

61. We are fully aware that changes to the machinery of Government must be given a great deal of consideration, particularly in the current economic climate. However, there is rarely an ideal time to reorganise Government Departments. We recommend that the Government Office for Science, while remaining a semi-autonomous body, be located within the Cabinet Office.

Identifying risks

62. The first stage of the NRA process is to identify risks. According to the Government's written submission:

Risks are identified by consulting, through Government departments, a wide range of experts who are able to take an informed view of the seriousness of the risks according to the criteria in the Civil Contingencies Act. After initial scrutiny, most proposals are taken forward into a detailed assessment phase; some may be kept under review.[60]

63. Of our four case studies, two are on the current NRA: pandemic flu and cyber attacks. The risk of disruption caused by volcanic ash was not. We were informed by the Government that:

For national emergency planning purposes, the risk of disruption to aviation caused by a natural disaster occurring overseas was kept under review annually for the National Risk Assessment (NRA), from 2005 to 2008. No review was undertaken in 2009.[61]

64. No explanation was provided for why the risk of disruption to aviation caused by a natural disaster was dropped from the NRA process. Clearly not all identified risks can be taken forward for further assessment and inclusion on the NRA. However, we consider that there should be a well-reasoned justification for excluding an identified risk, backed up by evidence. Therefore we were concerned by the comments made by Dr Sue Loughlin, Head of Volcanology at the British Geological Survey, who told us that "it wasn't particularly a surprise to the volcanology community that something like this would happen, but somehow that message hadn't got through to Government."[62] The Royal Geological Society also stated that:

some Earth scientists report that they have been warning Government and others of the potential for major disruption due to Icelandic eruptions for a number of years, but feel that little notice has been taken of these warnings.[63]

65. We recommend that the Government clarify why no review of the risk of disruption to aviation caused by a natural disaster, including volcanic eruptions, was undertaken in 2009; and provide the evidence behind the decision.

66. It appears that there may have been a breakdown of communication between the earth sciences community and Government. We recommend that the GCSA assess whether this was the case and improve the mechanisms by which scientists can engage with the Cabinet Office.

67. The other case study not on the NRA was space weather. When we announced our inquiry and the terms of reference in July 2010, we noticed that space weather was gaining prominence in political discourse. In the light of the 1989 CME event that affected Quebec's grid, the National Grid was of concern to us. The Minister for Security told us that although "every country [...] is specific in this" and "there are no generalisations", she believed that "there must be some risk" to the National Grid.[64] In September 2010 the Cabinet Office held a workshop on severe space weather with representatives from across government, the scientific community and the energy, communications and transport sectors. The purpose of this workshop "was to hold an initial exchange of views on the likelihood of severe space weather and possible impacts" which would "contribute to the process Government uses to understand risks in this area".[65] The Government is currently conducting a space weather risk assessment for the next NRA and NRR.[66] This represents progression on the Government's position as stated by the Minister of State for Energy and Climate Change (then Rt Hon Joan Ruddock MP) on 9 June 2009:

although solar storms are not included specifically in the National Risk Register, the resilience measures place to deal with the risk I have mentioned [complete outage of electricity supplies] would be equally applicable to the effects of solar storms.[67]

68. We were curious why space weather was being assessed for the 2011 NRA, given that space weather has been known about since the Carrington event which occurred around 150 years ago. We were told by Professor Mike Hapgood, on behalf of the Royal Astronomical Society, that:

We have been talking about this for a long time. I have been involved in these activities for 15 years or so. We had a lot of discussion around the previous solar maximum, as we call it, 11 years ago. But then interest decays away. [...] Because the cycle is so long, unless you are an expert and very deeply involved in it, most organisations tend to forget it during the quiet years of the solar minimum. [...] Now solar activity is rising again. We can see it coming over the horizon. It is helping to focus things. It is also the way the science and our understanding of the engineering impacts has grown hugely in the last decade. I think it is just a critical mass. We've reached that critical mass now.[68]

69. We are pleased that the Government is assessing the risks posed by space weather ahead of the next solar maximum. This is vital given that the Government believes the National Grid could be at risk. The Government should take all possible action to put in place and coordinate resilience measures across different sectors.

HORIZON SCANNING

70. As well as getting input from external experts, Government Departments and agencies can identify potential risks and threats through horizon scanning. There are various horizon scanning mechanisms in Government Departments and agencies. The Foresight team within GO Science produces in-depth studies looking at major issues 20-80 years into the future. The Horizon Scanning Centre (HSC) within Foresight carries out shorter projects looking 10-15 years ahead.[69] In addition, Scientific Advisory Committees might conduct horizon scanning.

71. Of key interest to our inquiry was the Cabinet Office's Domestic Horizon Scanning Committee. This committee aims to give Government Departments a "heads up on approaching potential disruptive challenges up to 12 months ahead".[70] It appears to be the primary horizon scanning body informing the Cabinet Office's risk assessment. We were therefore interested in how the Domestic Horizon Scanning Committee's work is assessed scientifically and asked Sir John Beddington whether he assessed its quality. He told us, rather disappointingly, "we are getting involved in that; in terms of assessing the quality of it, no."[71] We are disappointed that the GCSA has little involvement with the Domestic Horizon Scanning Committee in the Cabinet Office. We recommend that GO Science and the GCSA consider ways of assessing the quality of the Domestic Horizon Scanning Committee's work.

72. Before the SAGE mechanism, there existed a Scientific Advisory Panel on Emergency Response (SAPER), which was an informal expert committee designed to provide independent scientific advice to the GCSA (then Sir David King) on resilience and counter-terrorism issues. SAPER was also tasked to conduct independent, classified studies when required.[72] Rather than being an ad-hoc advisory group put together in an emergency, it was a standing committee. Membership and activities of SAPER were classified.[73] According to Professor Peter Sommer, Visiting Professor at the London School of Economics:

SAPER was set up by Professor David King when he was GCSA to support his role in COBR. […] The essential idea was that the GCSA needed to have a wide variety of sources to inform his advice. A number of scientists from the ministries, agencies and wider academia would be briefed about government plans for addressing emergencies both in terms of structure for decision-making and underlying analyses.[74]

73. It is unclear to us when and why SAPER was abolished. A SAGE is put together to provide scientific advice to Government once an emergency has occurred, that is, from the response phase onwards. SAPER, on the other hand, appears to have been a committee involved in resilience and preparation for emergencies. We recommend that, in replying to this report, the GCSA clarify why SAPER was abolished and to what extent its functions, particularly in planning for emergencies, have been retained and by whom.

74. We consider that the NRA would benefit from more scientific scrutiny. We recommend that a new independent scientific advisory committee be set up to advise the Cabinet Office on risk assessment. This committee should review the NRA, setting up temporary sub-committees as appropriate. Having an independent scientific advisory committee for risk assessment to review the NRA would improve public and parliamentary confidence in a necessarily unpublished document. The committee should inform the judgement of the GCSA in ensuring that all risks requiring scientific input and judgements have been properly considered in the NRA and support his greater involvement with the Domestic Horizon Scanning Committee.

Reasonable worst case scenario

75. The second stage of the NRA process is assessing risks and their impacts. Risks are assessed using available historical, statistical and scientific data. Where possible, the assessment should take account of probable developments over the next five years.[75] Impacts are assessed against five main criteria:

the numbers of fatalities that are likely to be directly attributable to the emergency;
the extent of human illnesses or injury over a period following the onset of an emergency;
social disruption;
economic damage; and
the potential for significant outrage and anxiety to be caused to communities.[76]

76. The assessment leads to the development of a "reasonable worst case scenario" for every risk. The reasonable worst case scenario is "designed to exclude theoretically possible scenarios which have so little probability of occurring that planning for them would be likely to lead to disproportionate use of resources."[77] The Government stated that:

They are not predictions of what will happen but of the worst that might realistically happen, and therefore we would expect most pandemics to be less severe and less widespread than the reasonable worst case. By planning for the reasonable worst case planners are assured that they have a high probability of meeting the demands posed by the hazard should it occur.[78]

77. We discuss the communication of the reasonable worst case scenario to the public and emergency responders in chapter 5.

78. Reasonable worst case scenarios existed for two of our case studies: the swine flu pandemic and cyber attacks. Because the specific vulnerabilities of critical cyber infrastructure tend to be kept out of the public domain, we have focused on the reasonable worst case scenario for swine flu.

SWINE FLU

79. The UK has been preparing for an influenza pandemic for years, having experienced three pandemics in the 20th century. In January 2002, the Chief Medical Officer for England published Getting ahead of the Curve: A strategy for combating infectious diseases, which identified a new pandemic as a particular disease threat.[79] Human pandemic influenza has been on the NRA since the first version was produced in 2005 and during annual reviews of the NRA it has been consistently identified as among the highest risks, when both likelihood and impact are taken into account.[80] The emergence of the highly infectious H5N1 strain of avian influenza in 2003 caused a great deal of concern, with fears that the H5N1 strain may undergo genetic changes enabling human to human transmission. Fortunately, this possibility did not materialise (the UK has been officially free from avian influenza since November 2008).[81] Following the emergence of the avian influenza virus, the World Health Organisation (WHO) raised concerns about the likelihood of another pandemic, which led to active preparations for a pandemic across many countries.[82]

80. The Department of Health (DH) is the LGD, responsible for identifying and assessing the risks, and for determining policy in preparing for a pandemic. Following the publication of the UK influenza pandemic contingency plan in 2005, a Scientific Advisory Group on Pandemic Influenza (SAG) was set up to advise UK health departments on the scientific evidence base for health-related pandemic influenza policies. In 2007, the role of the SAG was reviewed and membership of the group was expanded to include a wider range of scientific disciplines, including traditional infectious diseases-related sciences such as virology and immunology, and also sciences such as risk management, behavioural sciences and diagnostics. The group became known as the Scientific Pandemic Influenza Advisory Committee (SPI).[83]In 2007 the Department of Health and the Cabinet Office jointly published Pandemic Flu: A national framework for responding to a pandemic.[84] This refined earlier planning and formed the basis for the 2009 pandemic response.[85]

81. The result of much risk assessment and planning for pandemic influenza is a reasonable worst case scenario that suggests:

up to 50% of the population would become ill (with infection attack rates up to 80-85%), of which 10% to 25% are expected to have complications, half of these bacteriological;
there would be peak illness rates (measured in new clinical cases per week as a proportion of the population) of around 10-12% in each of the weeks in the peak fortnight;
absence rates for illness would reach 15-20% in the peak weeks;
case hospitalisation demand rates would be up to 4% with an average six day length of stay; and
there would be case fatality ratios (the ratio of deaths within the population infected with influenza, over a given period of time) of up to 2.5%.[86]

82. We questioned the concept of a reasonable worst case scenario, with the expectation that it would be, as the Government told us, "the worst that might realistically happen".[87] Therefore we were concerned when Professor Neil Ferguson, Director of the Medical Research Council (MRC) Centre for Outbreak Analysis and Modelling, told us:

That reasonable worst case scenario was based on the mortality we saw during the 1918 Spanish flu pandemic—namely a 2% case fatality rate [...] Now, the term "a reasonable worst case" is, by definition, not an objectively definable term; it is a subjective term. One could take the other extreme, and I remember David King and Sir John Beddington challenging what we were doing by saying, "Well, if you look at bird flu, that has a 60% case fatality rate", so the reasonable worst case is, of course, that bird flu becomes transmissible and we get a 60% case fatality rate. That was felt certainly to be a worst case but almost unpreparable for. So from the point of view of something reasonable for the NHS to plan for and reasonable in terms of cost, that is why the Spanish flu example was used.[88]

83. An independent review of the UK response to the 2009 influenza pandemic, chaired by Dame Deirdre Hine, noted that "there was some unease about how reasonable the 'reasonable worst case' scenarios were".[89] The review also stated that "there was general agreement that the term was unhelpful" because it implied that the scenario was likely to occur.[90] A key recommendation was that "the GCSA should convene a working group to review the calculation and presentation of worst-case scenarios".[91]

84. We asked the GCSA whether reasonable worst case scenarios were evidence-based and Sir John responded:

To the extent it is partially evidence based, it is quite difficult to come in any particular scenario to what is a reasonable worst case because in fact the very word "reasonable" implies there is something that is going beyond what would be pure analytic judgment. Following the swine flu outbreak and the inquiry by Dame Deirdre Hine, I have been charged with developing ideas on how we could calculate the reasonable worst case scenarios in a variety of situations. The Blackett group [...] is working on that at the moment and I have a couple of people who have made comments on what was the reasonable worst case scenario in the case of swine flu, but that is very much work in progress.[92]

85. The GCSA told us that the Blackett Group "is a set of groups that I bring together to look at particular aspects of scientific advice, bringing in and tapping in the academic and industry communities on a variety of areas".[93] The aim of Blackett Reviews is to go "beyond what might be termed more conventional thinking [...] bringing in completely different people [...] who have hitherto not been involved in these particular areas".[94] He clarified that, although members of the Blackett Group would be briefed in the public domain, "the application of [findings] and the individual ways that they might work through Government would be subject to some degree of confidentiality".[95]

86. We asked Rt Hon Andy Burnham MP, the former Secretary of State for Health during the swine flu pandemic, whether he perceived there to be an alternative to the reasonable worst case scenario and he responded "I don't actually, no".[96]

87. We are concerned that the word "reasonable" appears to be influenced by the need to find a reasonable level of public expenditure for contingency planning rather than outlining the worst scenario that might realistically happen, based on the best available evidence.

88. We welcome the fact that the GCSA is reviewing the concept of a reasonable worst case scenario. We request that, if possible, the results of this review are sent to us and published before any policy change is adopted.

89. We consider the communication of the reasonable worst case scenario in chapter 5.

The National Risk Register

RISK MATRIX

90. The final stage in the NRA process is the comparison of risks. On the National Risk Register—the unclassified version of the NRA designed to assist communities and the public—the risks are summarised on a matrix of relative likelihood versus relative impact.

Figure 2: An illustration of the high consequence risks facing the United Kingdom[ 97]

91. The NRR matrix is an attempt "to illustrate the breadth of the high-consequence risks we face"[98] although it excludes some risks that are classified for reasons of national security. We wanted to know whether the matrix, which simplifies a great deal of information on risk, was useful to communities and the public. On the one hand, it could be a valuable way to summarise complex risks in an accessible manner. On the other, it may be little more than an attractive diagram. The matrix is also currently being reviewed as part of the Blackett Group set up by the GCSA.[99] We asked the GCSA for his views on the usefulness of the matrix and he responded:

I think it is a useful tool, but there are some issues with it. [...] you have a point on that matrix. These are logarithmic scales so they are fairly robust to having a point, but, if you think about a number of events, the ones with less impact are likely to be more frequent. If you think about it, the reality is probably that you have something shaped a bit like a banana for any individual event—a banana sloping downwards.[100]

92. The reasonable worst case scenario provides an indication of relative risk. As we have outlined before, risk is a combination of potential impact—the hazard—and the likelihood of the impact occurring. Rather confusingly, the Government stated that the reasonable worst case scenario for swine flu was assessed to have a "medium high likelihood of occurring over the next five years".[101] When we asked witnesses for their views on what this meant, Professor Neil Ferguson commented that it was "questionable".[102]

93. Problematic risk comparisons within government have been identified before. In 2006, the former Science and Technology Committee's report on Scientific Advice, Risk and Evidence-Based Policy-Making found that:

There is no process in place to ensure that if one department describes the risk of an event happening as "very small", the probability involved is broadly similar to that of a different risk described as "very small" by another department. Nor is there any explanation or guidance available for the public on what a "very small" risk actually means—one in a thousand or one in a million?—or what sort of other known risks might be similarly described.[103]

94. The Committee recommended that "the Government build on existing work to develop, subject to academic peer review, a scale of risks for use by all departments, as appropriate, when communicating levels of risks to the public".[104] In its response to the report, the Government stated:

Just as the Government has not developed a standardised table of risks, as risks mean different things to different people, it does not agree that a common terminology or scale of risks would be helpful to [...] the public. [...]

The Government does however adopt a common methodology and scale in specific areas where the advantages outweigh the disadvantages, for example in assessing disruptive challenges to the UK. There is a duty on Category 1 responders (those organisations at the core of the response to most emergencies, e.g. emergency services, local authorities, NHS bodies), under the Civil Contingencies Act 2004, to assess risk in their area and communicate those risks by publishing a community risk register. The Civil Contingencies Secretariat in the Cabinet Office provides these responders with guidance on which risks to consider, a common methodology and a common scale for assessing the likelihood of those risks to ensure that there is some consistency between the assessments made.[105]

95. The high consequence risks summarised on the NRR risk matrix are broad in scope, encompassing accidents, deliberate attacks and natural phenomena with impacts ranging across health, infrastructure and the environment. However, terms such as "medium-high", used to describe the likelihood of the reasonable worst case scenario for pandemic influenza occurring,[106] are vague and unquantified. We conclude that it should be clear what criteria are used in developing risk comparisons, particularly when they cut across Government Departmental responsibilities. We recommend that the Government clarify the common methodology and scale for assessing the likelihood of risks that are used in developing the NRA and NRR.

LOCAL RISK ASSESSMENT

96. Local authorities are key recipients of information in the NRR and the risks identified in the NRR should inform the development of Regional Risk Registers (RRRs). The process is two-way: the risks identified in RRRs and Community Risk Registers (CRRs) should be fed back into the classified NRA.[107] This two-way communication between central government and local authorities is essential to planning—the vast majority of emergencies are local, and every national emergency affects local communities. In addition, there is significant expertise among local authorities, police forces and fire authorities where COMAH[108] sites exist. We requested written information from the Local Government Association (LGA), which has over 400 member authorities in England and Wales, on the relationship between local authorities and central government on the NRR and wider sharing of information. It stated:

In theory the development of the NRR is a two way process. [...] In practice the process is very top-down and provides very little opportunity for local authorities to input. [...] the NRR is rarely informed by issues identified at the sub-regional and regional level.[109]

97. We are concerned that the development of the NRA and NRR appears to be a "top-down" process hindering the involvement and influence of local authorities. This situation is unsatisfactory. We recommend that the Cabinet Office review its procedures to ensure that the input of local authorities is given full consideration and appropriate weight.

98. The LGA also expressed concerns about access to the classified NRA:

There is [...] concern and frustration amongst local authorities that officers with security clearance do not have access to the classified information in the National Risk Assessment, which makes it difficult to assess how the threats identified in the National Risk Register will impact on local areas and how local authorities should manage these through their emergency planning arrangements.[110]

We took this to the Minister for Security, who told us that "the classified document is available to those who have the right clearance to see it".[111] There are two issues here. First, that the NRR may provide insufficient information if access to the classified NRA is necessary for local authorities to plan for emergencies, and, second, that security-cleared officers have difficulties accessing the NRA. If it is the case that access to the NRR alone is insufficient to allow local authorities to assess the potential impacts of risks to local areas, and access to the classified NRA is necessary, then we question the operational value of the NRR. We recommend that the Government conduct a consultation with Category 1 emergency responders, including local authorities, to evaluate how useful the information on the NRR is for risk assessment and emergency planning.

99. We recommend that the Government review whether those with appropriate security clearance outside of Central Government have difficulties accessing the NRA, and put in measures to resolve the problem.

Behavioural sciences

100. Emergencies do not happen in a vacuum and the Government must consider the influence of human behaviour on the outcomes of an emergency. Human behaviours are particularly critical to a public health emergency that will rely on promoting compliance to recommended public health measures, including the uptake of vaccines. In the case of swine flu, the SAGE used the Behaviour and Communication subgroup of the Scientific Pandemic Influenza Advisory Committee (SPI) to address behavioural components of the Government's response.

101. For some risks, an understanding of behaviour should contribute to risk assessment. We considered this to be particularly true of cyber attacks for two reasons: (i) because attacks are launched by people; and (ii) the public have a role to play in maintaining cyber security. The first is beyond the reach of our inquiry, but we did consider the role of the public.

102. Denial of Service (DoS) attacks are carried out using the computers of unwitting members of the public. For a computer to be compromised it must run a malicious program, hence cyber security advice is to ensure that computers are capable of recognising malicious programs by using up-to-date anti-virus programs and ensuring there are no unpatched security holes (that is, the machine's software is being updated on a regular basis).

103. We came across some disagreement over what expectations could be placed on the public in maintaining cyber defences. For example, Professor Ross Anderson, Professor of Security Engineering at Cambridge University, told us that "people aren't going to do stuff. People have busy lives. People buy computers and they expect them to work".[112] Malcolm Hutty, Head of Public Affairs at the London Internet Exchange (LINX), disagreed:

I wouldn't be dismissive about the importance of encouraging the public to raise their own level of protection. I accept that this does not fix the problem, but this kind of problem is not fixed: it is managed. [...] The public is better protected when the public helps to protect themselves. Therefore, they should be encouraged to do so.[113]

104. There is little that automated defences can do when the user unwisely overrides the system's protection mechanisms. For example, criminals can spread their malware over instant messaging (chat) systems by arranging for all of the chat "buddies" to receive a message such as "is this your photo?" followed by a link. When the link, which leads to the malware, is clicked upon, the computer operating system will put up a warning about the risks. However, a great many users ignore this warning because they trust their buddy, and so will become infected and then, in turn, they send out misleading messages to spread the malware to all of their buddies. These novel types of attack and the general problem of how diligent people are in protecting their machines raised the question of whether the Government incorporates social and behavioural sciences in its risk assessments around cyber attacks. Professor Peter Sommer, Visiting Professor at the London School of Economics (LSE), stated:

The temptation is to think that with cyber security what we want is better encryption and better intrusion detection systems. All of those things are important. The social science aspect of it, criminology, human motivation and the economics [...] all of these are important research areas in understanding the nature of the problem and how you are going to manage it.[114]

105. We took this issue to Dr Steve Marsh, Deputy Director of the Office of Cyber Security and Information Assurance (OCSIA), who admitted:

To be honest, we have not done enough on behavioural science so far. Over the years people have concentrated on the technical response. We have been trying over the last three or four years through the Technology Strategy Board and elsewhere to bring in this broader range of issues. [...] we need to do more on behavioural science, we need to do more on the economics, we need to do more on forming relationships and so on. We absolutely need to bring in this broader scientific base, not just the technical response around the machines or networks themselves.[115]

106. A behavioural insight team was recently set up in the Cabinet Office "to help the UK Government develop and apply lessons from behavioural economics and behavioural science to public policy making".[116] The team is composed of "a small group of civil servants, drawing on academic and empirical evidence from the world's leading behavioural economists and behavioural scientists".[117] To date, it has produced one discussion paper; Applying behavioural insight to health, published in December 2010, which aims to promote debate.[118]

107. The GCSA recently admitted to us that an area where GO Science could do better was in "making certain that we link in better with the social science analysis community", adding that "social science needs to be built up more and I think on that I could have done better".[119] The former Chief Scientific Adviser to the Home Office, Professor Paul Wiles, had an important additional role as the Government Chief Social Scientist (GCSS). Upon his retirement in early 2010, a new CSA to the Home Office was appointed, but the role of GCSS remains vacant, although we note that the GCSS's function as head of the social science profession within the civil service is being covered by two civil servants.[120]

108. We consider that an understanding of human behaviour is essential in risk assessment, contingency planning and emergency response. We are disappointed at the lack of focus on social and behavioural sciences in Government to date. We expect the newly established Cabinet Office Behavioural Insight team to provide input to risk assessment for emergencies.

109. We may return to the topic of social science in Government in future. In the meantime, we would like to know whether and when a Government Chief Social Scientist will be appointed to replace Professor Wiles.

Conclusions

110. Risk assessment underpins preparedness. In turn, risk assessment should be underpinned by the best available evidence. We were very disappointed to learn that the GCSA has had little involvement with what is a cross-Government process. It appears that, for both the volcanic ash emergency and the recent severe winter weather, the GCSA had been asked to provide advice after the emergency had happened, although we note with interest that the severe winter weather was not deemed an emergency. This is simply not good enough: scientific advice and evidence should be integrated into risk assessment from the start.

40 Ev w15, para 1 Back

41 "Governance and risk management", The Treasury, www.hm-treasury.gov.uk Back

42 "Risk management: definitions", The Treasury, www.hm-treasury.gov.uk Back

43 Ev 94 [Government Office for Science and Cabinet Office] Back

44 Cabinet Office, National Risk Register of Civil Emergencies, 2010 edition Back

45 Ev 94 Back

46 "Civil Contingencies", Government Office for Science, www.bis.gov.uk/go-science Back

47 Qq 329-31 Back

48 Q 332 Back

49 Q 333 Back

50 Q 383 Back

51 Q 384 Back