TIETO26 exercise puts the focus on crisis preparedness in food sector
Finland’s strong security of supply is based on decades of consistent preparedness and practice thereof. An increasingly turbulent and uncertain world brings darker tones to the national TIETO exercise.
Russia’s aggression against Ukraine has revealed how the food and water supply systems, which are critical for security of supply, are also interdependent. Ukrainian food production has suffered in many ways during the war, in everything from primary production to industry.
The agricultural sector is particularly vulnerable to cyberattacks due to, among other things, inadequate cyber security measures. Russia has systematically attacked Ukraine’s grain stores, ports and logistics centres.
Hacker groups have also targeted the water supply in Ukraine. For example, in 2018, the Security Service of Ukraine prevented an attack on a water treatment plant, which could have caused a serious environmental disaster. Russia has adopted a routine of combining physical attacks with cyber attacks – preventing ict systems functionality and destroying infrastructure.
Finland is prepared for threat situations, but extensive cyberattacks could, at their worst, cause serious disruptions to society’s operations and manifest as, for example, empty retail shelves and problems with the food and water supply. This would also increase chaos in society and the risk of anarchy.
In a digitalised world, disruptions develop rapidly and take many forms, which is why we need to strengthen our preparedness to respond to different threat scenarios, even potential war situations. This is also the aim of the renewed TIETO26 exercise, which focuses on food and water supply chains.
“The strategy of the National Emergency Supply Agency (NESA) highlights food and water as key areas of security of supply. Nothing works without them,” says Juha Ilkka, Chief Preparedness Specialist at the NESA.
The strategy of the NESA aims to ensure that society is prepared for the possibility of military conflict, wide-ranging influence and serious disruptions in the global economy.
“The planning of the TIETO26 exercise is already in progress. In the practice games, we may even go over such severe situations where we simulate military events and the invoking of the Emergency Powers Act,” says Antti Nyqvist, Head of Preparedness at Digipooli.
The exercises evolve with the changing world
Initially, dealing with disruptions and securing telecommunications was practised under the leadership of the Finnish Defence Forces. Gradually, the national TIETO exercises have been transferred to Digipooli of National Emergency Supply Organisation (NESO), and from forests to office and remote conditions. “The place where businesses and authorities normally operate,” Nyqvist says.
The entire security of supply organisation has been involved in previous TIETO exercises, and the coming exercise will focus on the food and water supply and their supply chains, which include both the energy and ICT sectors. In addition, feedback from participants in the TIETO24 exercise has guided us to focus more closely on a single supply chain. They hoped to be able to practice and test out situations which are as realistic as possible and related to their own industries in the intensive phase of the exercise.
Digipooli hopes that a broad range of Finnish food and water supply companies and supply chain operators who may also have operations in Sweden or Estonia will participate in the exercise.
“We are also trying to attract food industry authorities from neighbouring countries to participate in the exercise so that we can practice cooperation,” Nyqvist says.
Previous exercises have also shown that limiting priorities and industries improves the effectiveness of the exercise.
“Participants will receive more industry-specific preparation training before the intensive phase. We are mapping out the teams’ goals and increasing feedback on the completion of the training and practice. The teams will also receive an assessment of how well they performed in the game,” Nyqvist says.
“Thanks to company-specific detailed feedback, the lessons learned are more likely to be adopted as the organisations’ practices,” Juha Ilkka goes on to say.
The TIETO26 exercise will also focus on the development of communication between companies, industry supply chains and authorities. Timely, clear and targeted communication is essential for coping with a crisis.
“It is important to practice how, to whom and with what words to communicate. We also need to practice how AI can be used in crisis communications. This way, we will be prepared for potential real-life situations,” says Hanna Kivelä, Chairperson of Digipooli and Managing Director of Fujitsu in Finland.
The entire company to exercise, including management
Companies benefit the most from training if senior management also participates in the exercises with their employees.
“Management must act as a role model for the entire company. This way, the entire organisation understands that preparing and training for crises is more than just a slide in PowerPoint,” says Hanna Kivelä.
At Fujitsu, preventing disruptions in telecommunications and cyberattacks is vital. The company therefore practices for many different disruption situations.
“We livestreamed the TIETO24 exercise internally for the entire personnel, even though there was only a smaller core group of management and responsible persons at the exercise itself. This allowed everyone to see and participate in the exercise in a smart way. I also recommend that other companies adopt a similar practice. It is important that all employees have a concrete idea of what acting in a crisis looks like in reality. In this way, training becomes a company-wide thing, and that’s exactly what preparation is,” Kivelä emphasises.
International with a Finnish twist
Although an international dimension to the TIETO exercises is desirable in a globally operating world, the aim is to keep the exercise Finnish going forward as well. The international cooperation of companies for any widely affecting incidents is in the focus in TIETO26 exercise. Exercises between states are their own matter.
Swedish and Estonian authorities and the NATO Cyber Defence Committee were involved in the TIETO24 exercise to monitor the training. In the TIETO26 exercise, internationality will mainly be seen in the international organisations and supply chains of Finnish companies and the authorities of neighbouring countries.
Text by Antti Nyqvist / Digipool and Leena Filpus / Kubo
Lisätietoja
