ISC2Congress: Against All Odds – What Dr. Richard Harris Learned From The Tham Luang Cave Rescue

nThe Tham Luang cave rescue in Thailand in 2018 is celebrated today as annextraordinary example of the triumph of human ingenuity and resilience innthe face of an apparently bleak situationn

n

nAn important protagonist of the rescue was an Australian cave diver andnanesthesiologistnnDr Richard Harris. Although only one member of a larger team, his keynote presentation atnISC2 Security Congress in Nashville last week underlined how his unusualnblend of professional and personal experience conspired – whether he wantednto face it or not – to make him a critical decision maker in the plan to getnthe boys and their coach out of the cave safely.

n

nThe rescue was a success, but leaving the description at that would be tonignore the complex and often uncomfortable calculations Harris and hisnco-rescuers found themselves having to make. Like many cybersecuritynchallenges, the solution may be found and the challenge overcome, but it’snthe many branches that teams and individuals had to explore, many leading tona dead-end, that provide the learning and character-building experience.n

n

nCave rescues are a rare event and the people who know how to conduct themnare rarer still. Every decision carried life and death risk. Even ancompetent mission could fail, putting in danger not only the boys but thenrescuers themselves.n

n

nIt was the theme of risk and calculation which Harris offered as hisnexplanation as to why ISC2 invited him to address an audience from anseemingly very different field, that of cybersecurity.n

n

n“You might wonder what a cave-diving anesthesiologist has got to do withncybersecurity. For me, I think there is a great deal of overlap. The mainnthing I want to talk about is risk management,” said Harris. “In retrospectnI’ve been managing risk pretty much every day of my life.”

n

nAn Australian ‘unicorn’n

n

nWhen events leading to the rescue started to unfold on June 23, 2018, ansuccessful rescue would have seemed like a vanishingly unlikely outcome. Anyoung coach had led 12 members of a boys’ soccer team 3km (1.86 miles) intona cave complex in Northern Thailand they had visited many times before. Uponntrying to leave, they discovered that heavy rainfall many miles away hadnflooded long sections of the complex, blocking their exit.n

n

nNone of the boys’ parents even knew they were even in the cave, and it wasnonly the discovery of bicycles and discarded belongings at the entrance thatnalerted the authorities to their predicament. Step forward, an experiencednteam of British cavers who lived locally and knew the complex well and who,ntogether with members of the Thai military, started to formulate a rescuenplan.n

n

nExtracting the young and frightened boys through flooded caves would benextremely dangerous, both for the boys as well as the cavers themselves. Anrange of skills were needed – knowledge of the caves, diving experience, butnalso it turned out, medical knowledge. Once described as a unicorn in thisnrespect, Harris fitted the bill on all three fronts, which is why the teamnof British cavers eventually called for his help.n

n

nHarris spent his life diving and exploring cases during which he’d developedna strong interest in the theme of how to rescue people from flooded caves.nHe was also an anesthesiologist. It was realized this would be essential tongetting the boys out, none of whom had ever dived before. Bringing youngnboys through long flooded tunnels with poor visibility raised thenpossibility they might panic. After formulating numerous plans that seemedndoomed to failure, drugging them for safety reasons was deemed an essentialnelement of any rescue attempt.n

n

nNeed to actn

n

nHarris and the rescue team didn’t even know which fork into the cave complexnthe boys had taken but guessed they had taken a southerly route. In fact,nthe boys had no food with them and had not dressed for an extended say.nAfter being trapped, the flooding in the complex worsened as they sat in thendark to preserve their head torches. The danger was not just potential – anmember of the Thai military drowned taking supplies to the boys once theynhad been located in the caves.

n

nThe total diving time through the caves was a terrifying three hours,nextracting the boys four at a time over three days. Even with sedation, thenrescue would be a titanic undertaking with only a very small chance ofnsuccess. Harris was roped into the rescue attempt, arriving some days intonthe incident unsure about how he could help.n

n

nHarris and the team confronted appalling dilemmas that would not have beennobvious to anyone outside the situation that involved fine technical andnmoral calculations. With oxygen levels in the cases dropping, what happenednif the rescue failed, and the young people or rescuers also died – who wouldnbe held responsible? As foreigners, they were aware of their vulnerability.nWhat would happen if the day none rescue failed, and boys died – what wouldnthis mean for the second attempt? Was there a point at which the team wouldnhave to simply leave the remaining boys to die in the caves?n

n

n“Sometimes doing something is easier than doing nothing,” said Harris.n

n

nIs there a second message in Harris’s experience of this rescue forncybersecurity people? Perhaps it’s that some adversity isn’t always bad fornus. Having to confront difficulty, even incredibly dangerous situations,nhelps to build resilience in the long run. In a very different context, thisnis something cybersecurity professionals must face on a regular basis,nknowing that their failure could sink the entire company. There is alsonexistential risk as well, as anyone defending healthcare will attest.n

n

n“A little bit of challenge in life definitely makes us stronger and morenresilient. Confronting your fears is a really good thing.”n

n ]]>