How to Lead Through Chaos with Crisis Expert Juliette Kayyem

Natural disasters don't wait. Global pandemics don't ask permission. And crises, they arrive without warning. And today's guest builds leaders who are ready when they do. I'm Susan Drumm, and this is The Enlightened Executive, where your personal evolution sparks your leadership revolution. Each week, we spotlight cutting-edge strategies to help executives and entrepreneurs grow in their leadership and life. Today, we're diving into what it takes to lead when everything goes sideways. And I can't think of anyone better to guide us than my longtime friend and fellow Harvard Law classmate Juliette Kayyem. Juliette is a national leader in crisis management and homeland security. She served as President Obama's assistant secretary at the Department of Homeland Security and was Massachusetts Homeland Security advisor. Now, she leads major initiatives at Harvard's Kennedy School and advises public and private sector leaders on how to prepare for and respond to disaster. She's a CNN senior national security analyst, a Pulitzer Prize finalist, and author of 6 books, including The Devil Never Sleeps, described by The New Yorker as an engagingly urgent blueprint for disaster readiness. Well, Juliette, welcome to the show. I'm so excited to have you here, and it was great that we got a chance to connect connect in the spring about, what, 6— I think it was about 6 months ago at our law school reunion.

So gosh, our fifth, our fifth, our fifth, our fifth.

Oh yeah, sorry, fifth. So great to have you. Thank you for coming.

Well, I'm so thrilled to be here, and thank you for having me.

And so I think about your career, what an incredible career you've had since law school. How did you get into the field of crisis management?

I had a sort of course correction, eureka moment. I should say right after law school, I went to be a real, as I say, a real lawyer. And I litigated cases at the Department of Justice in the national security and counterterrorism space. Very counterterrorism in particular in 1995 was very niche, you know, very few cases. And in some ways my career sort of happened to me because of September 11th. There were very few experts in the space. I began sort of my academic career with the writing and the teaching after that. But it was really 2001 2005 when I really think about sort of how did I get into this space. And that was, I was home, my middle child had just been born, and I'm watching TV. And I'm, you know, I'm in counterterrorism and, you know, 19 terrorists and 4 airplanes and doing all the things that are necessary to protect our nation. And I'm watching Hurricane Katrina sort of drown New Orleans and what we call a response or preparedness apparatus really not ready for a different kind of threat. We had been like sort of so focused on this one. So sort of fast forward, so my career has now been in government, the private sector, and in media. And teaching has really been— I say I have one career and many jobs. And I'm really in the sort of the get ready preparedness space, sort of anticipate the bad thing and then be ready to minimize the harm. So I always— the mantra I use in my class is always, we're going to learn to fail safer. We can't stop all bad things from happening, but we can minimize the harm if we're ready.

Yeah. So it sounds like the preparedness for the potential bad thing to happen is obviously key in your work. What are some of the insights or mindsets that leaders need to think about with regards to that?

So part of it is— I should just say that my field is changing dramatically because of the nature and timing and scope of these crises. So you have a little blip here and consequences there. So it's The doctrine, the disaster management doctrine, like a lot of other things, is under stress because of this. So, but generally how we used to think about it was what I call, you know, sort of left and right of boom, right? So the boom could be anything. And if you're a CEO, it could be some disruption to your supply chain. It could be, you know, if you're an offshore oil drilling company, it could be a blowout preventer, which is a protective feature, no longer protects the drill and you have an oil spill. It could be anything. And we talk about left of boom, which is all the things you do to stop the bad thing from happening, and then the boom, and then right of boom, which is the preparedness, response, recovery, and eventually, one hopes, resiliency. We used to think about disasters both as random and rare, which I don't think we can anymore. I don't, I don't talk about crisis leadership. I talk about leaders in crisis, right? Because every leader now has to anticipate that they will have a crisis. They will manage the crisis. They will, guide the crisis. You can't— there's not like a group of crisis leaders that you pull off a shelf and they become the CEO when the bad thing happens. And I focus on sort of the, what, you know, the ride of boom. And so what are some of those features? So one is get your head around it. That seems— I always say assume the boom. That seems obvious. Most leaders think that they have their head around it. But they— when I say that, I really mean that what are the details of what your preparedness planning are? Because the pressure will be so great on that leader at the moment of that crisis. Look, a crisis is different than all the other problems that any industry has because your ability to respond in a successful manner is truncated in time. I always say your runway is short. So if you're a CEO and the runway is short, you better be ready or find ways to extend the runway. A second thing is what I call situational awareness, which— or what we call in the field situational awareness is that when the disruption happens, are you confident in being able to understand what in fact is happening, what will happen, and the consequences to your industry. You can't learn that in real time, and you can't learn that on truncated time. So I always call it the what, so what, and now what. Set up mechanisms. You might have a franchise. You might have people out in the field. You might have a team internal. You might have an intelligence division, right? So what, what is happening? So what? Does it matter to my equities, to my company, to my cause? And then the now what is how am I going to deploy resources to minimize the harm? There are lots of other things. But if I am asked what are the two things that matter the most, it's a leadership that embraces the failure, embraces the failing safer, and brings the right people to the table. Second, an awareness by the leader of what is in fact happening in real time so they can use their best judgment. And that requires a team that's willing to engage. It requires you as the CEO or the leader to bring in the right team. And even for public companies to think about your board membership, something like 6% of public boards, only 6% of public boards have someone at the table who understands response, preparedness, cybersecurity, climate disasters. Like, you gotta bring them to the table because they gotta give voice for your company of, of, of what could happen.

And what could happen. So let's talk about, I, I love the bifurcation as sort of right and left of boom. Because you're, you're talking right now about the events happened and what you need to do. So couple lessons learned there. And then I wanna go back to the pre, because what can we do?

Yeah.

Um, obviously that's where we spend, should spend the most time, but Let's say the crisis is here. One of the things that I've seen leaders go wrong is they're not considering the impact more broadly on all stakeholders. I mean, certainly we've seen companies who— there's an issue that's also affecting the environment or it's affecting others outside the company and their lens is too narrow and they're just focusing on the company. And then that becomes a PR crisis for them. What have you seen in terms of missteps that people have made once a crisis has presented itself?

That's exactly right. So this stakeholder engagement, I'll give an anecdote in my world and in the sort of public sector disaster world during the BP oil spill. So that's a major, largest oil spill. I mean, two things. So one is our outreach to the community was really, as responders, was really only the maritime or the oil, you know, industry. It was not like— an oil spill like that, like everyone is impacted. The oceans are closed, the restaurants are closed, everything. And so we really struggled to sort of be able to engage, listen, and empower through information. See, in a disaster, people want to feel agency. So if you either ignore them or you don't give them a capacity to engage and in fact assist, your response capabilities will be wrong. So an example is, and I wrote about this in the book, that I was sitting in sort of the BP response, total nightmare in terms of our response and our ability to respond in time. And we're starting to get calls from the Treasury Department. I'm in the Situation Room. And the Treasury Department says, we're getting calls from the Prime Minister's office in London. And we're like, what? And of course BP, the B stands for British. And the message that was coming to us was, you can criticize BP, you can hate them for what they're doing, they could be part, but the UK government as well as pensioners, their economy, everyone are very dependent on this company surviving. And so you can be mad at them, but you can't kill them, right? Like in other words, and I'm like, this is very far from an oil spill. Like all of a sudden I'm talking macroeconomics economics and pension funds. And it's that kind of— so we call it— and it's great you mentioned that because when I say we call it sort of imagine the cascading losses. So the boom makes it think like there was something that got blown up and you have to clean it up. No, because you think about the cascading losses that can occur if you're not able to manage the disaster or as the disaster goes through your communities. We do a lot of tabletops of which exactly you're imagining, okay, what could be the the ripple effects. And then as importantly, what do we do now, as you said, the left of boom, to engage people so they know this is a potential consequence? And what would we do to empower them? Empowerment in a disaster is so important because if people feel like they have no agency over their community, their economic destiny, their livelihood and their lives, they will behave in ways that may be unhelpful. To, to the response.

What's an example of empowering?

Yeah.

Empowering someone in a situation like this?

Yeah. So a lot of times it's information. It's really interesting. I have this analogy that I think about, like, imagine you have a friend who says, I need to cut this loaf of bread. Will you put your hand here and tell me when I'm close? Okay. So they're cutting the piece of bread. You're going to tell them really far away from where your hand is that they're done, right? Because you have no control of the danger. Imagine the opposite. You have the knife and think, You're cutting right up because you know how to do this. And I always think like, you got to give the person both the loaf and the knife. And so a lot of that is information. It is absolutely what is happening and why is it happening. So for example, like we have— and empower them to make a decision based on the risk. So we have a problem in hurricanes and disaster management, which— and we got lots of issues around information and disinformation and But in a hurricane, generally, if we do this right, people generally evacuate because you're keeping them informed. But about 8% of any population won't evacuate. They'll, you know, for freedom, pets, whatever. We've been able to adapt to pets and have shelters now that take pets. People will not leave their dogs behind. We have to understand that as disaster managers rather than force them out. But there is a freedom, what we call the freedom group, right? Which is, this is my house. I rode out the last one, whatever. That is fine. If you want to take that calculation, that is fine. Here's the information I owe to you as the, as the person staying put. It is that for 3 days I cannot and will not deploy resources to save you. So now we're not talking the hurricane, we're talking 3 days. And secondly, and this is a tactic used in Florida, conservative state, here's a Sharpie pen. Put your name and Social Security number on your arm. Because if you do drown, it might be hard to identify you and you wanna be able to contact next of kin. Well, now I've given them the correct risk calculation and lo and behold, lots of people will load their cars. It's not to scare them, it is simply to say, I'm giving you the information to be able to relate this. Think about communities that don't often have seats at the table, right? So a minority community or an immigrant community, what are the ways that you can give them them information so that they don't— or sometimes an insular conservative community— so they can understand what the risk is to them and their community. So a lot of it is information. Some of it is mantras like 72 on you, which is if you live in a high-risk zone, have 72 hours, if you can afford it, provisions and water and everything that will just get you by. Chances are you're not going to have to wait 72 hours, but it will relieve stress on an apparatus that may need to, to, that may need it more than that, more than you. And, and we never give numbers to these things. So for your watchers, 72 hours. So for water, we always say 1 gallon of water a day for everyone in the house. So family of 5, that's just 15 gallons. It's a, it's a, it's a trip to Target. We got to make it much, much much easier for people. I would say on the CEO side and on corporate side, there's obviously lots of stakeholders they have to consider from the board to the vendors. Think of a mega event. We have FIFA that we're going to be managing in the months to come and Olympics. But also, of course, your employees. They are as invested in the success of the company as you are. If you close them out, if you lawyer up, if you don't communicate and show empathy, they will either create narratives are unhelpful or tune out where they can be helpful. So, you know, and we saw this, we saw, we saw CEOs get very creative in COVID with videos of them at home and leaders at home. And I think that's really, really important.

Yeah, that connectivity and staying connected and sharing information. Keep sharing, keep sharing, keep getting out in front.

We have a, we have like a need to know, right? In the, in the, in the intelligence world, in the disaster management world, right? It is share and know. Right? In other words, because people generally make pretty good risk calculations about themselves if they have the information. But if they feel like you're hiding something or they're infiltrated with misinformation, you know, those vacuums will get filled by fear and panic and lies. And we've got to push back on that. For sure.

I mean, I think there's that whole phrase, in the absence of information, people make it up. And so your job is both to share what you know but also to share what you don't know.

Exactly.

So people don't feel like you're withholding something. Like, we don't know yet. That's where I see some of the best practices happen.

What I tell leaders is there's two things you can do, one before and one during the disaster. Right. So the first thing you want to do as a sort of crisis leader is make sure that you have the mechanisms in place to share information in real time. Because as you said, that vacuum will get filled very, very quickly. That's not hard to do. People sometimes call it crisis comms, and it kind of is, but you can build it now. You don't have to be surprised by it, right? What, what are the mechanisms? What, what will you want? So we call that the battle rhythm. So let's say you have an incident. Let's say you're a shipping company and the Suez Canal closes, right? So that is gonna be possibly a long-term disaster. You already know what you're gonna do operationally. The ships will go here or there. Or whatever to get to this. But maybe your employees don't know it because this person is in the finance office and that person is in that office and that. So, so you can already set up a way to communicate to everyone, set up Zoom, set up even recordings and do it consistently. It can't be one and done. It's got to be, you know, you know, tomorrow at 3:00, I'll be back here to answer your questions. Tomorrow I'll be back here at 3:00. Like you set up this bandwidth.

The second— Yeah, that. Yeah, the emergency broadcast system is there. Yeah.

Yeah. And one of the benefits we've learned, especially in policing, is if you tell people when you'll be back, they are less inclined to create all sorts of meshuggeneh, as you say, in between, you know, when you got up. Like, if you say, we'll be back in touch, you're going to like after a day, it's like a date. Like, well, when is he calling? Like what? Like you want to set up a specific battle rhythm. Over the period of it, and then let people know. So let's say things start to subside. Then you say, well, we've got things under hand, or these operations are up and running. I'm going to come back to you in a week and let you know what our after-action is. What are our lessons learned? I'm not happy with this. So that empathy and that outreach. The second is in the crisis. The whole class is on crisis communications, whole books on it. I have it down to 3 words, numbers and hope. Hope. When I study leaders in crisis, and I don't believe disasters happen because one person did one stupid thing, right? These are systemic networks that are falling apart or whatever because of lots and lots of decisions made. But when the leader is asked to step forward, it is incumbent on them to do two things, to have the facts, right? What numbers, right? And the data, what's happening, what's down, what are the— what's the priorities of operations getting back up? Like, be transparent with people. They're going to figure figure it out. The second is hope. And here's what— we're doing this so that by tomorrow we'll have that, or the next day we'll have that. The best leaders during COVID Prime Minister of New Zealand did that, right? It is, here's where we are, not looking good, pretty bad, but here's where we hope to be. So numbers and hope. And I think more recently, even in the political scrum that we're in, if people remember just last week from when we're taping, Governor Cox in Utah really took on leadership role during this horrible political assassination of Charlie Kirk, where if you look at all of his press conferences, it was, here's what we know. To your point, here's what we don't know. Yeah. And here's how we're going to get through it.

Yeah.

And I think, I think, I mean, I think people are going to study that, like, right? It is just literally that's, that's what people want. And you left those press conferences feeling like during this horrible thing, when things are getting more horrible, that, that he had a handle on his commitment.

He's got a path forward.

Yeah.

Okay. So now let's look at the flip side, right? Before, what are, what should leaders be doing today? How should they prepare? And where are the biggest missteps that you see leaders making?

Right. So I mean, I'm a big fan of having leadership with a keen understanding of operationally, how will it work when the boom comes, right? You cannot delegate this. And I have done so many trainings where like a CEO is like, oh, my security team, has that. Well, you wouldn't tolerate that for a CEO if he said that about his financial team or his legal team. Like, yeah, you expect a CEO to own this. So you, you have to own it. So two, two of many, many things that, that we, that we sort of did are through— I'll, I'll give you three, three before the boom. So one is focus less on risk in your planning, right? This risk or that risk or that risk, right? And focus on your, on the consequences should there be a disruption. Because you are not gonna know what the thing is that worries you.

And just what I was going to ask you, like, how do you even anticipate how it could have—

Right. You know, so I'm a generic boomer, right? Or I'm a generic devil, right? The devil.

No, we're Gen X.

Exactly. But I have to tell you, like, so many people get so fixated on, well, the probability that's a problem that when you actually take a step back, when things are so integrated and complex and combined now, it's hard to disassociate, you know, a cyberattack from physical consequences. Consequences now. But if you prepare and have a keen understanding of what the consequences are, you can do that now, right? You then will be able to drive the resources. It's not just for information. Drive the resources to be able to get what is of fundamental importance ready for the disruption. So lots of companies have cyber planning before the boom and have physical planning before the perm. You better merge them, right? Because we have no idea what's about to happen. And look, any plan is going to be 80% correct. So like, it's not going to get you all the way there, but it's going to get you the basic features. So, so part of that is educating on what your risk is and what the consequences will be should that threat appear. So that's number one.

Do the consequences though, don't you need to know— you do need to kind of identify what are those key risks?

I, I mean, you do, you know them now. I mean, it's like, no CEO is not going to know. I mean, everyone asks like, like, the risk analysis is like really hard. It's like, you know, I get these things from companies companies that, you know, is like our, our risk assessment for 2025, you know, for US companies, China, you know, it's like, okay, I knew that. The weather. Yeah, I knew that one. Like, I mean, has anything, I don't mean to be like, has anything, anything been a surprise? You're, you, I always focus on the disruption because any good CEO is gonna know, know what the risk is, right? And what the challenge is, is gonna be how are you? And that's all, that's your planning and preparedness. And that has to happen before before the boom. The second is test what we call your— test for single points of failure. Lots of systems, especially complex ones, can be— often are dependent on a single person, crazy, or a single system, slightly less crazy. So we call it a single point of failure, which is if that thing were to go down, right, what kind of redundancies in hindsight morally, legally, reputationally, financially, you will wish that you had done if the boom arrives. A lot of people rely on what we call single points of failure. And if there is, you know, in engineering, you know, there'll be like maybe a single feature. No engineer would build a system that had a single point of failure without multiple points. So you can test those now and it might be awesome. Also a person, right? It could be like, make sure your social media feed isn't solely run by a consultant, uh, whose name is Julie, who you've never met, by anyone by Zoom, right? I'm— and I'm serious, you can't— you cannot imagine how many companies, you know, like, all hell will be breaking loose. I'm sure you've seen this, and then on Twitter they already have like a pre-planned thing, and you're like, they're kind of missing the moment. Like, you know, you don't want to look like you're, you're not attuned to what is going on. And then the third, so we worry about single points of failure. And then what we call in the language of disasters is the normalization of deviance. I don't know how much that permeates in your world, but during the, and so my cautionary tale beforehand is don't normalize deviance. It's telling you something. When we study—

What do you mean by a deviant?

So when we study this, it came out of this the space shuttle Challenger disaster. How did this happen, right? How does it— and there's always a technical explanation. In that case, it was the O-ring, right? The O-ring didn't survive, whatever. But when you really drill down, it was a system, an organization, and an atmosphere, an environment that viewed a variety of what would be called deviances in engineering, but basically blips, right? Like, what do we call it? Like, we call it, you know, like pilots call it ghost in the cockpit. Things they know when an airplane needs mechanical fixes because you can't explain it. It's just like this thing that where things are feeling like they're being slightly disrupted. Lots of companies view their ability ability to get through that deviance is a sign that the system's working. In most cases, it's a sign that the system's under stress. So before the boom, we are constantly— people in my field— educating CEOs and their teams. What are the deviances that you're ignoring? Maybe blips, whatever. Remember when the Super Bowl in New Orleans, for example, went in half darkness? Remember when the lights went out at that Super Bowl in the third quarter about 10 years ago in New Orleans? And when we go back to study these, like, what happened? Yeah, to a T beforehand. Lots of people who knew the system said that they felt that there were gremlins in the system, but they just kept going forward because they were able to sort of bypass the gremlins. So, you know, watch for the ghosts in the cockpit.

There's signals, right? These little signals that could tell you that there's something afoot, right?

That you don't want to believe because you think the system is just going to run. But I will say This left and right of boom, conceptually, it's very helpful. But also, as we're seeing, it's sort of more of an infinity loop now, right? That the better you can be in left, traditional left of boom, right? The fewer consequences you will have right of boom. It's not, I don't do good, I do less bad, right? Because something bad is going to happen, but you'll be able to minimize the consequences. And then the floor didn't drop. Your institution or company is ready, right, for the next disruption, whatever it may be.

Yeah. And so what would you recommend a leader do? What's one thing they could do tomorrow that would help prepare them and make that infinity loop—

Yeah. Yeah. —less stressful? As I said earlier, if you ask me what's the one thing that I wish someone had or that is the through line of bad crisis management. And it is the inability of a leader to understand what is happening in real time, the what, understand the consequences to their institution, and then the so what, and then the now what, and then being deployed. So I spend a lot of time building situational awareness mechanisms for a company. It's going to depend on what the company is. A small company is going to be much more well aware of X, Y, or Z, but do you have your ear to the ground about weather? Do you have your ear to the ground about your supply chain given the tariff issue? You wanna be ahead of the curve and understand what's going on. Information, information then, information not for information's sake, information so you can deploy resources or pivot perfectly. More generally, if this is helpful, The way I live, you know, I think about my sort of value-add in this world, if there's any, is that I'm expecting the crash landing. Lots of things I wish could have happened that didn't, and I'm expecting the crash landing. And there's only— and most landings, most plane crashes that occur on runways occur at the end of the runway. If you have enough runway, you're okay because you can basically guide a plane, but it is when a pilot runs out of runway. So I always say, you know, if you know the crash landing is happening, either be ready for it, that's all the Left of Boom preparedness, all the planning I've been talking about, or try to extend your runway, right? Be able to buy yourself more time. And you do that through having redundancies, having secondary, tertiary markets, whatever it is in your area. And ours, you know, in disaster management, say for weather, we think all the time about how do we give people more time so that they can protect themselves, you know, protect their community. So that's what I, you know, I say either be ready for the crash landing or try to extend your runway, and then maybe you could fit all the specific pieces into that.

Well, you've given us some great things to consider and think about. And, you know, so many times CEOs are looking ahead to opportunity and, uh, but really you need to balance that with looking ahead at the potential risks and how you're going to prepare yourself and your company and your employees and all the stakeholders that might be affected by what happens. So thank you so much for coming on the show, for having me.

People learn more about you and your work, uh, so a couple things you can— well, you can look on my website and for all my written work and academic work and media and corporate work, or they can contact me at my company. We just look at Juliette Kayyem, J-U-L-I-E-T-T-E-K-A-Y-Y-E-M.com for my email, and I'm happy to help in any way.

Awesome. I was so personally excited to have you on the show. Thank you for doing that. So great.

And so great. And thank you for everything you do of like, you know, You certainly know the challenges that we're in right now, whether they're the kind of crisis I worry about or just more generally. So empowering people, you're in the empowerment business too. Yes, that's very true. Both are. Yeah.

So if you like this episode, you're not going to want to miss my interview with Candace Mama, a dynamic CEO, speaker, and survivor who talks about the power of forgiveness. Let's all lead the way. Hope you enjoyed today's episode, and I'd like to point you to the next important step. Hit the subscribe button to get notified when we release new content. I'll see you on the next episode of The Enlightened Executive.