On Complex Systems.

Last month, the U.S. government declared emergency powers in order to keep fuel supply lines open, due to fears of shortages following a cyber attack on the Colonial pipeline. This one pipeline provides almost half of the fuel consumed on the east coast of the United States. Following a ransomware attack on Friday, the entire pipeline shut down. As of yesterday, The Colonial Pipeline Company has managed to reopen some of its smaller lines but the main lines remain closed. This one cyber attack now has fuel traders in a frenzy over possible severe impacts on prices. One 5,500 mile pipeline that spans from Pasadena, Texas to Linden, New Jersey and New York Harbor serves some of the nation’s largest transportation hubs, including the Hartsfield-Jackson airport in Atlanta, Georgia.

It would be easy for me to point out this tremendously consequential cyber attack as a reminder that anything you put online is subject to being stolen and held for ransom. 20 years ago, none of us put our desks, patient charts and filing cabinets out on the front lawn overnight, so that criminals could walk by and steal anything they wanted. But today, we put all our financial data, intellectual property, business trade secrets and sensitive personal information like passport numbers, social security cards and drivers license information in the cloud. We store credit card numbers, bank account details and passwords online. We do all of this assuming we’re safe, but we’re not.

If one of the largest fuel pipelines in the country can be shut down by cyber criminals, you and I are easy targets if they turn their eyes towards a dental practice. So, please make sure you have competent I.T. professionals who secure your networks and devices. If you have at-home employees working remotely, make sure their devices are secure and use two-factor authentication. Make daily backups of everything. Set and enforce a strong acceptable use policy and don’t take your eye off the serious business activity of protecting your data.

But, that’s not the point I really want to make in this article. If you look a little deeper and consider what’s going on, the real story is how interconnected and complex most systems are. The Colonial Pipeline Company is a privately-held company with headquarters in Alpharetta, Georgia. Before Friday, unless you work in the energy sector, you had probably never heard of them. Now, they are facing severe scrutiny and I’m certain, a lot of sleepless nights. One cyber attack didn’t just expose how vulnerable our fuel supply lines are, but also how everything else is downstream.

In his Burleson Box interview, Dan Heath, author of Upstream, talks about how critical it is to understand the downstream consequences of every decision, initiative and system in our businesses. Too often, we fail to go upstream and identify the real problem. Heath shares a parable about a kid who floats by two men fishing in a river. One man jumps in to save the kid and just after he pulls him to safety, here comes another kid floating down the river, struggling and in need of urgent help. The other man jumps in to save the next kid and when both men and the two kids are safe on the shore, another kid floats by in need of help. One man jumps in again, exhausted, trying to save the kid, but the other man walks away.

“Don’t walk away now,” says one man to the other, “I need your help! Where are you going?”

He replies, “I’m going upstream to strangle the idiot who keeps throwing these kids in the river.”

The big challenge in any business, enterprise, industry or organization is not the single step that goes wrong, like a cyber attack, but rather all the complex, interconnected pieces that flow downstream and the interdependence of huge airports like Atlanta’s Hartsfield-Jackson and all of the refineries and energy and transportation that is placed at risk by one mistake that happens upstream. In your practice, it’s wise to name and measure key performance indicators (KPI) on a regular basis, not only so that you know when something is amiss, but also to help identify vulnerabilities and weaknesses upstream and downstream of each KPI.

For example, a downturn in new patients might be the result of an advertising campaign’s fatigue or increased ad costs that reduce your audience exposure (i.e. upstream) or it might be that your phones aren’t being answered (i.e. downstream) and you’re missing new patient phone calls. Reduced efficiency and underutilization in your hygiene department or clinical treatment outcomes might be a result of poor scheduling (upstream) or recalibration and team training (downstream) that leaves them ineffective.

Physical therapists teach new students to look above and below a muscle or joint injury, as the culprit is often an overcompensating muscle or ligament activating to support the real area of injury. Airports and transportation hubs would be wise to look above and below (i.e., upstream and downstream) of their operations and when times are good, to ask “What could we do that might really screw this up?” and in times of crisis, “What’s happening upstream that should be mitigated immediately?”

You and I should be asking the same questions, continuously, before something big happens that prevents us from living out our mission and fulfilling our vision.