Day two of the simulation arrives, and Corman lays out the new reality: Numerous water mains across the country have broken. The man-made drought has spread to hospitals, data centers, refrigeration, and manufacturing.
Then Corman throws another curveball: He plays a prerecorded video statement from a fictional military official appealing to the insurance companies’ help in responding to the geopolitical threat posed by China, the first time that country’s name has been spoken in the game so far. “I’m most concerned about our ability to protect our military mobility, a key element of national security,” the official tells them.
Corman hands out the day-two assignment: As the disruption spirals outward, how will they prioritize now which of the water utilities deserve their resources? The “biggest-customers-first” or “first-come, first-serve” answers from the prior round, just a few minutes earlier, now seem hopelessly naive. Will they focus on restoring water in places where they can save the most lives, such as hospital-dense cities? Or will they seek to minimize economic harm? Or heed the military’s request to focus on national security, essentially prioritizing the military’s response to China’s potential invasion of Taiwan?
Fortunately, no one in the room is a monster. After 15 minutes of breakout conversations, the teams around the room render the same verdict, that their first priority will be to save human lives—though none spells out how they’ll make the endless impossible decisions that follow from that answer.
Only one person, after all six teams have given that same answer, speaks up to raise an uncomfortable point. Prioritizing harm to people above all else may not be an option. “The easy answer is public safety, human life,” he says. “The more difficult one is when you do have regulators or someone calling, shareholders asking questions.”
“If Treasury is calling and asking numbers, and we’re saying we’re focused on human life, I don’t know if that’s the actual talk track,” he goes on, using a sales term for a phone script of talking points for client conversations. Or, he adds, if an official is telling the company it needs to focus on telecommunications or “dual use” infrastructure—meaning things that might have military importance—that might become “priority number one,” he says.
In other words, taking the most direct action to protect people from harm in the midst of a catastrophic cyberattack might require breaking contracts, flouting the military’s demands, or directly contradicting a larger US government strategy in the early days of an unfolding war.
“We didn’t agree on that as a table,” he says. “There’s not going to be a consensus.”
At this point, abruptly and mercifully, Corman ends the game to start a lessons-learned session. During this round, he’s put up a slide that represents some of the infrastructure disrupted by the second-order effects of the hackers’ cyberattacks. Next to each is a long line of multicolored dollar signs and outlines of people, representing financial loss and human casualties.
There’s no point in counting these as if they’re some sort of score or demerit, Corman assures me when I ask afterward. They’re less a quantified measure of losses than a qualitative assurance that things have gotten very bad. He’s gotten his point across: If this game has any winners, they’re not in the room.
