Gaming businesses must plan judiciously for emergencies such as the Resorts World Manila attack, natural disasters and accidents so they can respond effectively when best plans fail.
Arson at Resorts World Manila a year ago, Typhoon Hato battering Macau last August and the Las Vegas concert shooting in October underscore crisis management challenges the gaming industry can face. Cyber attacks present a different set of emergency challenges. A panel at this year’s International Association of Gaming Advisors (IAGA) Gaming Summit in Macau brought crisis management expertise from operator, regulator and security professional perspectives, with this reporter as panel moderator.
Panelists AG Burnett, a former chairman of the Nevada Gaming Control Board, Las Vegas Sands Executive Vice President Lon Jacobs and Omnirisc Security Managing Director Ekraj Rai agree that the key to crisis response is preparation. Plans need to cover the three broad types of crises – natural disasters, accidents and adversarial situations – and address issues such as the safety of patrons and employees, asset protection and coordination with other stakeholders. Those responses must then be tested: practiced through tabletop exercises and crisis simulations internally and with public agencies, competitors and others. The results of those exercises need to be evaluated and plans modified accordingly.
Planning to that degree requires a major resource commitment. It’s critical that top executives recognize crisis management isn’t just a security concern but a risk management issue with potentially serious financial consequences.
“You have to speak to them in a language they understand,” Rai says. “You have to tell them that it will affect their revenue, their employees, their customers.”
MIKE AND IKE
AG Burnett quotes boxer Mike Tyson: “Everybody has a plan until they get punched in the mouth.” As surely as a punch in the mouth causes pain and confusion, a crisis generates a fog that complicates responses, and emergencies unfold unpredictably.
“I like to quote President [Dwight] Eisenhower (the World War II Allied supreme commander responsible for the Normandy invasion) who said, ‘The plan means nothing, the planning is everything,’” Jacobs says. “You need to try to anticipate everything that’s going to happen and you need to educate your team, you need to drill your team so that they get muscle memory, so that when a crisis hits and the plan doesn’t work they are able to respond quickly and intelligently.”
As Typhoon Hato approached Macau, Jacobs recalls, “We had a plan set to go, we knew it was coming, we had generators ready, we had extra supplies ready, we thought we were in good shape and it worked the way it was expected. We lost power, the generators worked, but what we hadn’t planned on was losing the water supply. It doesn’t sound like quite that big of a deal, but without the water you have no cooling. You risk losing your entire IT system and then you’ll lose your entire business.
“This was not part of our planning, we didn’t anticipate it, but what we were able to do was because of this muscle memory, because of this intensive training, we were able to come up with creative ways to maintain a sufficient amount of water to keep the IT system running. That’s what’s so important about the planning, just continuing to be ready for whatever comes your way even though you know that the plan you come up with is not going to work.”
TALKING THE TALK
A key component of crisis management is communication among stakeholders and with the public. Different situations prescribe lead agencies, but all actors must be connected.
“Those duties, roles and tasks need to be discussed beforehand, because when it does happen, it is simply chaos,” Burnett, whose Nevada Gaming Control Board tenure included the 1 October shooting that left 58 dead and 851 injured, says.
Nevada’s Gaming Control Board enforcement division includes armed agents. Primary response came from other law enforcement agencies, but Burnett took the initiative to announce Control Board agents were present in casinos as a warning to possible accomplices or copycats.
“I wanted to project to the outside world that we would have folks undercover, out and about,” Burnett, now a partner at Nevada law firm McDonald Carano, explains. “I wanted to do that publicly as a warning to stop anything further from happening. Fortunately, of course, this was an individual act.”
Social media introduces a new dimension to the puzzle. It can be an effective communication tool for companies and authorities and a channel for misinformation. “We used to say, ‘We don’t comment on rumors,’ but now you can’t. You have to address social media,” Jacobs says.
“Language is a key issue,” says Rai, who is based in multilingual Macau and fluent in four languages himself. Top casino executives across Asia may not have a common language with many employees, customers and local officials.
“The heads of departments must have someone to communicate directly with the government and locals so there’s transparency and clarity,” Rai says, and those arrangements need to be made in advance.
INTO THE BREACH
These days, cyber attacks pose the most frequent threat to gaming business.
“A lot of work goes into trying to anticipate and avert where breaches may come from and trying to keep data secure as much as we can,” Jacobs, who serves as Las Vegas Sands’ global general counsel, says. “But once it happens, it becomes something that requires the entire company to be involved.”
Responses often require outside technology experts and raise numerous legal questions, Jacobs says.
“When do you alert the people who have been the subject of the breach? When do you let law enforcement in? When do you let in the regulators?” he recounts. “There are so many different constituents.”
Once the initial emergency is over, focus turns to business recovery, from the bottom line to company reputation. If the crisis extended beyond the boundaries of your business, recovery efforts should as well, Rai says.
“If something happens to the bank or the bus company, it effects all of us. So we all have to work together.”
He notes that in the days following Hato, Melco deployed construction contractors and equipment from its Morpheus project to help clear debris from Macau streets.
Once the recovery has momentum, it’s time to evaluate the crisis management plan and the response team performance, then make fixes for next time. You can bet there will be a next time.