Amid rising geopolitical tension, Nic Labuschagne, APCO’s Head of Strategy and Crisis Management, argues that most Gulf organizations are still treating crises as technical glitches rather than chaotic, information-driven battles for trust. For media, marketers and CMOs, his message is straightforward: silence is reputational self-harm, playbooks are minimum hygiene, and real resilience depends on agile “special forces” teams empowered to act before the manual even opens.
What did the crisis communication landscape look like in the Gulf, and how prepared were organizations on February 28?
Most of our clients, certainly the ones that I have been working with, did not ask specifically for us to prepare for the coming conflict. Many of them were hoping the conflict would not come at all. It was actually only our own organization internally. Often consultants are accused of not taking their own medicine, but we started the process about two weeks prior to the conflict kicking off, and we did our own scenario planning and built up a framework in order to be able to manage our own operations.
Because of the success of that approach, we shared this with some of our clients and the penny dropped for them. They said, “Please, can you package that and come and help us pull our crisis management work together?” So the short answer is: very few organizations that I am aware of actively prepared for this. Anybody who lives in the Gulf who does not have an eventuality of a conflict with Iran is probably not doing their crisis preparation work properly. So those plans would have been in place, but they were just plans.
What we discovered, and I think this is an interesting observation, is that even the best-prepared organizations had done their preparation in silos. You had the business continuity people doing their business continuity, the operations people doing their operations crisis management, and the comms people doing the comms crisis management, but the level of integration that was required was absent or not as well developed as it should have been. That is where a lot of the work has come from: understanding how to mesh all of these together and make decisions quickly on the fly as the situation adapts.
Using playbooks is the absolute minimum starting point for this kind of crisis, and they do not help you beyond the first contact, so to speak. You have got to be hands-on. You have got to have a small team of empowered decision-makers who can make decisions on the fly rather than asking for approvals or authority all the time. And you have got to constantly communicate, firstly with your internal staff, to make sure that they are okay and that operations can continue, but also with your clients to explain what you are doing in order to be able to continue delivering your work to them.
What are your takeaways from how this crisis was handled across the GCC?
I think a lot of lessons from COVID-19 were taken on board. COVID-19 was good preparation for something like this. Yes, we did not have the kinetic element, if I can put it that way, but we did have people dying in hospitals, so there was still that scare element. I think the governments became much more sophisticated in their approach to mass communication about crises to their populations, and government and business became far better integrated in their response to large-scale crises.
What differentiates the responses was the degree of intensity of attacks on the various countries. The UAE unfortunately seems to have borne the brunt, although they have done probably a better job than anybody else in terms of defending the country. The UAE has been a bit more active than the other countries in terms of responding, and the messaging has been consistent and clear throughout. It has been “keep calm, carry on as normal”, but at the same time they have communicated really well the resilience measures they had already put in place to protect the country, the people, and the economy.
You see issues related to food security, supply chains, and the safety and security of the population. All of those things have been well thought through and now put into action and then communicated clearly, so people know the government knows what is going on, the government is doing something about it, and they are clearly communicating to all the stakeholders what is going on.
How does the narrative get shaped in a crisis when you have multiple stakeholders and you need to communicate on the fly?
There is communication at two layers, really. There is the government communication, the broad messaging at the government level, and then there is communication by the other major stakeholders in the economy and society. At the government level, there are clearly unified crisis communication networks at play. There is no way that everybody could be speaking from the same sheet if they were all operating independently, so this is part of the preparatory work that was done. They have been very clear on how to approach it, the manner of the communication, and the messaging has been consistent from all corners of government.
What has been interesting is to see how the corporate sector has aligned its messaging with that of the government as well. They are not scrambling like mad to keep sales up, to promote products and services. They have fallen in line with the government messaging and they have subsumed their brand priorities, if I can put it that way in marketing speak, to the needs of the government and the population at large.
How important is preparation for communicating at such scale across the GCC?
There are two things to bear in mind here. I think it was Benjamin Franklin who said that if you fail to plan, you plan to fail. Everybody knows this. But there is another one I borrowed from years ago. I had to do military service, and the first lesson they taught us in officer school was that no plan survives first contact with the enemy. It is a combination of those two. Preparation is absolutely vital, but the old-fashioned playbook: do your risks, do your scenarios, develop the playbook, train the people on the playbook, is the absolute base minimum that you need to be doing. Everybody should be doing that.
What is really difficult is managing what we call emergent risks, risks that you have not identified, are not aware of, or that could come out of left field, and then how to deal with the situation as it changes all the time. We use an approach called strategic foresight, which involves a lot of preparatory work because it looks at trends and the drivers of those trends. Then we look at a portfolio of scenarios.
If you are working for a client, let us say in the healthcare sector, you would ask: what does the future of geriatric healthcare in the Middle East look like? You would build scenarios and then backtrack from those scenarios to today and plant signposts. You then use your media monitoring to look for those signposts to see which of these scenarios is emerging and what you can do to capitalize on it or protect yourself from risks that might be associated with it. That level and complexity of analysis has been somewhat lacking in the region. Firms have done the playbook and crisis manual stuff, certainly the reputable firms, but when it comes to the more sophisticated understanding of where these weird risks can come from and how they can metastasize into other things, that has been lacking.
Should organizations wait for things to go back to normal before communicating? What should they be doing now?
People should not be waiting for what is next. They should be communicating now to make sure that they are able to bounce back when all of this is over. The best time, and this has been shown throughout conflicts, to communicate is during the conflict, not after the conflict. You cannot wait and see how things turn out.
If you are an investor in the tourism sector, you are investing in the physical place and you are investing in the reputation of the environment and the experiences. You have a tangible piece and an intangible piece. If you are investing in the region’s tourism right now, the intangible piece is the worry part. That is where the reputational risk lies. Investors hate uncertainty, so you have got to keep on informing them. You have got to make sure that the leadership of your tourism entity is visible, that they are sharing verified information about what is going on all the time, because investors need data in order to do their risk planning.
You have to engage with your key stakeholders, tourists, operators, logistics firms. Everybody needs to be kept in contact, kept up to speed with what is going on all the time. Of course you are going to get hammered by what is going on right now, but the chances that you will rebound far more quickly are higher because you will still be top of mind, the money that was targeted for you is likely to flow to you much more quickly, and you will be able to recover much more quickly. Anybody who is sitting on their hands right now and waiting to see which way the wind blows is making a mistake. They need to be actively engaging with their stakeholders right now.
All of this has to be done within the framework of the broader government communication. You do not want puff pieces going out which are clearly misrepresenting the situation. My suggestion would be much more hard-nosed. I would think of it more as investor relations communication at this stage, because that is the nuts and bolts of what is going to drive your business at the end of the day. It is the money to make sure there is investment in the business so that it is viable, that there is a place up and running for people to actually visit.
Are you seeing a shift from the initial silence among brands and agencies?
I think people are changing. They have realized that this might go on for longer than the few days or weeks that they initially thought. They are tempering communication to make sure that they are aligned with the government narrative, and then they are working on the sort of “business as usual under the circumstances”, if I can put it that way.
They are starting to fill the gap. They have realized they cannot keep silent. They have bottom lines to maintain, staff to pay, mouths to feed, and the economy needs to go on. The communication needs to be tempered to the circumstances. It is careful, it is measured, but it is definitely starting to swing up.
What lessons from COVID can be applied now in the tourism sector in the GCC?
A number of measures were taken by governments to ease the burden on the tourism sector. You see right now they are reducing things like tourism taxes. They are giving payment holidays, as far as I understand, for certain types of payments. Instead of paying this month, you have three months to pay for it. They are trying to address the pressure on cash flows for hospitality organizations, trying to reduce the tax burdens and even the reporting burdens, to try and extend the cash flow that is available.
Inevitably, there is going to be an impact, and they have seen it in the hotel occupancy numbers and numbers of visitors. Those are logical to expect. From a government preparation point of view, they are doing the best they can with the tools they have available to lessen the burden on the hospitality sector. At a broader level, their messaging about business as usual, keep calm, has also allayed concerns to a large extent about the stability and safety of the region for people to come here. It is a constant mantra, a constant message.
For destinations that rely on outside investment to develop, they are starting to take steps to communicate clearly with their investors about what is going on on the ground with verifiable information, to make sure that investors know they are still in the game and that it is still a very good, long-term, viable investment opportunity.
The region speaks to residents, investors, tourists and international media at once. How do you strike the right tone?
That is where the hard-nosed investor relations tonality comes in. It is pragmatic, it is practical. It is an acknowledgement of the situation, but it is also an acknowledgement of context. These conflicts come and go. COVID came and went. We are no strangers to conflicts in the region. Everybody has lived through them, maybe not as directly as they are right now, but indirectly.
It is important to put a long-term context in place so that people can understand, yes, we are going through a tough time right now, we will recover, and when you recover, you want your operation to be ready to accept the tourists who are going to be coming back. So let us talk about the practicalities of that.
You have experience across banking, national security and chemicals. How do different sectors manage reputational risk in a crisis?
It depends on whether the product or service is tangible or intangible, the complexity of the offering, and the level of regulatory control over the industry. If you take something like an oil and gas installation, they are very strong on operational capability, security, managing breakdowns, fires, emergencies of that nature, and they have very strong business continuity and crisis management protocols. If something bad happens, they can clamp down on it immediately and resolve it as quickly as possible.
On the other hand, if you look at a financial institution or a bank in particular, their products and services are intangible, highly regulated and complex, and they are much more focused on sentiment and on reputation. For oil and gas, practical, quick resolution to a crisis is the demonstration of their operational capabilities. People who buy their products and services really care about getting good quality products and services from them, so if they fix the problem quickly, that is a demonstration of a good reputation.
On the banking side, it is much more difficult because if you and I feel that the bank is not carrying its weight properly, might be doing things that it is not supposed to, we cannot rely on it. That is much more intangible and difficult to deal with. In that case, they focus their resources much more heavily on the communication side to make sure that people understand what is going on inside their operations, to make sure that they are transparent, fully compliant with the regulations, and that they are doing what they say they are doing. They have to focus much more on reputation management than the operational, tangible, product-focused organizations need to.
Any examples from the recent Gulf crises that illustrate these differences?
If you look at the oil and gas installations that have been attacked so far, you do not see a lot of communication from them other than the bare facts: “X has happened, it is under control, and it will be fixed within such-and-such a period.” For most people, that is enough. They trust the capabilities of the people on the ground to be able to do exactly what they say.
On the other side, when AWS was attacked recently in Dubai, there was a statement, but the knock-on effect was not just on Amazon. It is all the people who subscribe to their services. Certain banking institutions that we are aware of were hit very heavily and had outages of several days which had a major impact on their reputations. There was very little discussed or talked about this in the media. Clearly, if you are a bank, you do not necessarily want to be talking about these things, but you have to let your clients know that there is an issue and it is being resolved and there is an expected time period within which it should be resolved.
Silence in these circumstances is not helpful. You do not have to lay your dirty washing on the line. You do not have to give details of what has gone wrong, but you do need to give reassurance that you have recognized there is a problem and your experts are dealing with it and you will keep people informed. As soon as you leave a gap, it is likely to be filled with misinformation or disinformation by people who want to destroy your brand.
People will forgive you if you are able to at least give them some kind of timeframe and some kind of expectation rather than being silent. Silence is inadvisable.
How do you see information warfare, deepfakes and misinformation playing out in this conflict, and how should organizations respond?
In this conflict, people are finally starting to realize that information is just as much a weapon as a missile is. Governments have done a really good job of being pragmatic about it. They have explained to people: here are the verifiable sources of information; if you are uncertain about anything, go and have a look there. I have advised people to be really careful about, first of all, sharing stuff that is not verified, and second, about posting things without thinking about them, because it has implications.
There is no silver bullet for deepfakes and disinformation, certainly not yet. There are tools that can help you identify whether AI has generated a deepfake, but with clever workarounds you can use videos from another location or time so that although it is disinformation, it is not going to be caught by the AI tool because it is genuine content. The only thing you can do about it is make people aware that disinformation exists and give them a place to get verified information. You have also got to address very quickly critical attacks on your reputation that are fake. Governments have been very quick, almost immediate, in responding and saying, “This is fake news, this is false,” and then directing people to verified sources. They have been quite good at nipping those things in the bud.
You cannot catch everything. If you are sitting on X trying to figure out what is going on, the vast majority of stuff, unless it is coming from verified sources, is rubbish or speculation or opinion. It requires critical thinking. Just because we receive things does not absolve us of the responsibility as individuals to apply our brains and triangulate for the truth. Most people see something, it hits a particular bias or belief system, it fires off emotions, and the first thing they do is share it with all their friends or colleagues without thinking. We have all been guilty of that to a certain extent. Hopefully this is a broader lesson: think before you share. That is probably a good mantra to bear in mind.
What will change in the crisis playbook by 2027?
Maybe the fact that you do not have a crisis playbook at all. I say that in jest, but here is the reality. In systems thinking, there is a framework called the Cynefin framework. It was developed by David Snowden, and it is a really useful tool to understand what kind of problem space you are living in. It goes from simple to complicated to complex to chaotic, and there is a little space in the middle which means you can transition from one of these phases to the other.
Manuals live in what we call the complicated space. To give you an example, if you are a Boeing technician, you would have a very thick manual that helps you maintain a jet engine. You pull out the manual and it will explain exactly what you need to take it apart, check for things, repair it, put it back together, and the engine will work, because that system, although it has hundreds or tens of thousands of parts, we know how all the bits work together. That is a complicated system.
A complex system is when you prod in one place and you get an unexpected response elsewhere. Complex systems are things like the climate, and most situations where humans are involved, because we behave weirdly. Crises live in the chaotic space. That is when you do not know what on earth is going on. The first thing you are trying to do in a crisis is move it into a space where you can start to put some control around this fireball that you have got in your hands. Having a manual does not help you when you are in that space. You cannot pull out the manual and say, “On page 32B it says we must do X, Y, Z,” when two seconds later the situation has changed to something else. The manual is useless then.
We are starting to understand that this is much more a behavior change in the way we deal with crises. You need teams of people who are empowered to deal with chaos and complexity and respond to the stage so that you can then use the manual. There is a higher-level flexible thinking that needs to be introduced in order to manage the crisis before the regular manual-based protocols can be kicked in.
We have tested out this whole approach using internet-based crisis simulation tools, and what we found in many cases is that the very senior leadership in organizations, which is really good at delegating strategic stuff, often is not so great at dealing with crises because they have passed that stage of having to roll their sleeves up and deal with day-to-day things. We found that the managers one or two layers below are far better, far more competent at dealing with crises. They can ask advice on the strategic stuff from folks at the top, but they are the best people to handle the crises.
There is a lot of internal organizational work that goes into creating the best crisis management team without upsetting the organizational hierarchy and without disrespecting the experience and knowledge of the senior people. A much more dynamic, growth mindset needs to be adopted for crisis management rather than a fixed mindset of “here are the crises, here are the risks, here is your manual, if that happens, do that.” That no longer really works. That is the absolute minimum level of preparation that is needed.
Where should crisis management and crisis comms sit within the organization?
It should be the function of the managing director or the chief executive officer, but it does not live well in the structured hierarchy that we have in organizations. Organizations, as we have them traditionally, are hardwired to carry out functions in the most efficient way possible. Organizations are complicated but not necessarily complex. Crises happen in the complex space, so you cannot easily niche a crisis management function in an organization that does not recognize the vague nature of what it is.
You are probably better off creating a multidisciplinary team that reports directly to the CEO or the managing director but does not live in a box in the hierarchy. This team needs to be treated a little bit like special forces. If you take a conventional battle structure for an army and then you take your special forces, your special forces are analogous to the crisis management team because these are multi-skilled, multidisciplinary people who can do a bunch of things under weird and very dangerous circumstances. Your traditional army is good at “there is the target, go and take it out,” and they apply all their force in that one direction, which is what a traditional hierarchical organization is really good at. The two are very different, but they are serving the same chief.
There needs to be more active and frequent integration between crisis management and all the other risk elements of the business, business continuity, operations and so on, so they all work together when a crisis happens. A lot of simulation work needs to be done and a lot of understanding of the complexity of the environment so they can look for potential crises over the horizon and pre-empt them. There is a big difference between preparing and pre-empting. By pre-empting, what you do is look at the circumstances that are feeding a potential crisis and address those circumstances so the crisis does not happen in the first place.
The world has become far too complex for us to sit back and think that we can solve all of this using a bit of thinking and a manual. With the advent of artificial intelligence, both in supporting what we are doing as crisis managers and in driving new kinds of crises, teams are having to rethink completely the way they deal with crises. It is both a threat and an opportunity, to put it bluntly.
