ONE OF THREE

The second emergency
has no owner.

The first emergency is the event. The second is the fallout. We have just lived through an example of the difference and we are not applying it.

A sustained failure of connected infrastructure is critical infrastructure failure. That makes it municipal emergency management, not a federal technology file. Ontario municipalities carry a statutory duty under section 4 of the Emergency Management and Civil Protection Act, with standards set in O. Reg. 380/04, and cyber attack is already a recognized hazard in the provincial hazard identification and risk assessment.

I am not claiming there is no material. There is plenty. Provincial plan guidelines and a generic template, the AMO and MISA municipal cyber security toolkit, the LAS incident response program, and the Five Eyes guidance on agentic AI. My argument is narrower and, I think, harder to answer.

Since 1995, emergency management has divided into crisis management and consequence management. A municipality only ever performs the second. Almost everything already published is an instrument of the first.

The assumption under test is a plan built around an incident that has a resolution, facing an event that has none. I raised consequence management years ago. Nobody was especially interested then either.

The strand I think matters more

The behavioural response to a credible short-horizon public warning is a separate emergency from the hazard itself. There is no risk-communication protocol for it. Pandemic planning did not anticipate its own ramifications. Isolation. School closure. Children left behind. Reported family and intimate partner violence. That is recent lived experience and it should be applied to this hazard class now, while it is still cheap to apply.

I am not trying to alarm anybody. I am trying to get the second emergency assigned to somebody before it arrives.

What is published, and what it costs

Three documents. A tabletop exercise on sustained loss of connected infrastructure, Volume One, three modules and thirty one questions. An eleven page briefing package. A five page briefing note. All free to read, free to use and free to share. No permission required, no fee, and no little box demanding your email address before revealing page two. Attribution is the only ask.

The exercise contains structure and no technical content, deliberately. The same discipline I used in leaving the acoustic numbers blank in the by-law. I am not going to pretend to expertise I do not currently hold.

Working notes

The file keeps moving, so there is a standing notes section rather than a second volume. Numbered, dated, each one on its own permanent address, and never quietly edited or backdated afterward. Note 01 is that the second emergency has no owner.

Note 02 is the one I would read first. In emergency management the scenario and the hazard are separate objects. You can run a pandemic exercise all day without releasing anything. In an AI security evaluation they are the same object, because the only way to learn whether a system can breach something is to let it try. Several times this year the wall between the test and the real world has not held.

That is not an argument against testing. It is an argument for writing down, in advance, where the boundary sits, who verifies the answer, and who has the authority to stop something a machine has already started.

Machine output is now entering consequential decision chains. Militaries, hospitals, utilities, dispatch. Most institutions cannot yet say where that happens in their own operation, or who is allowed to pull the handle. That is a planning assumption, and planning assumptions are written before the event or they are not written at all.

Read the working notes

Everything else on the main site