The Tham Luang cave rescue in Thailand in 2018 is celebrated today as an extraordinary example of the triumph of human ingenuity and resilience in the face of an apparently bleak situation

An important protagonist of the rescue was an Australian cave diver and anesthesiologist Dr Richard Harris. Although only one member of a larger team, his keynote presentation at ISC2 Security Congress in Nashville last week underlined how his unusual blend of professional and personal experience conspired - whether he wanted to face it or not - to make him a critical decision maker in the plan to get the boys and their coach out of the cave safely.

The rescue was a success, but leaving the description at that would be to ignore the complex and often uncomfortable calculations Harris and his co-rescuers found themselves having to make. Like many cybersecurity challenges, the solution may be found and the challenge overcome, but it’s the many branches that teams and individuals had to explore, many leading to a dead-end, that provide the learning and character-building experience.

Cave rescues are a rare event and the people who know how to conduct them are rarer still. Every decision carried life and death risk. Even a competent mission could fail, putting in danger not only the boys but the rescuers themselves.

It was the theme of risk and calculation which Harris offered as his explanation as to why ISC2 invited him to address an audience from a seemingly very different field, that of cybersecurity.

“You might wonder what a cave-diving anesthesiologist has got to do with cybersecurity. For me, I think there is a great deal of overlap. The main thing I want to talk about is risk management,” said Harris. “In retrospect I’ve been managing risk pretty much every day of my life.”

An Australian ‘unicorn’

When events leading to the rescue started to unfold on June 23, 2018, a successful rescue would have seemed like a vanishingly unlikely outcome. A young coach had led 12 members of a boys’ soccer team 3km (1.86 miles) into a cave complex in Northern Thailand they had visited many times before. Upon trying to leave, they discovered that heavy rainfall many miles away had flooded long sections of the complex, blocking their exit.

None of the boys’ parents even knew they were even in the cave, and it was only the discovery of bicycles and discarded belongings at the entrance that alerted the authorities to their predicament. Step forward, an experienced team of British cavers who lived locally and knew the complex well and who, together with members of the Thai military, started to formulate a rescue plan.

Extracting the young and frightened boys through flooded caves would be extremely dangerous, both for the boys as well as the cavers themselves. A range of skills were needed – knowledge of the caves, diving experience, but also it turned out, medical knowledge. Once described as a unicorn in this respect, Harris fitted the bill on all three fronts, which is why the team of British cavers eventually called for his help.

Harris spent his life diving and exploring cases during which he’d developed a strong interest in the theme of how to rescue people from flooded caves. He was also an anesthesiologist. It was realized this would be essential to getting the boys out, none of whom had ever dived before. Bringing young boys through long flooded tunnels with poor visibility raised the possibility they might panic. After formulating numerous plans that seemed doomed to failure, drugging them for safety reasons was deemed an essential element of any rescue attempt.

Need to act

Harris and the rescue team didn’t even know which fork into the cave complex the boys had taken but guessed they had taken a southerly route. In fact, the boys had no food with them and had not dressed for an extended say. After being trapped, the flooding in the complex worsened as they sat in the dark to preserve their head torches. The danger was not just potential – a member of the Thai military drowned taking supplies to the boys once they had been located in the caves.

The total diving time through the caves was a terrifying three hours, extracting the boys four at a time over three days. Even with sedation, the rescue would be a titanic undertaking with only a very small chance of success. Harris was roped into the rescue attempt, arriving some days into the incident unsure about how he could help.

Harris and the team confronted appalling dilemmas that would not have been obvious to anyone outside the situation that involved fine technical and moral calculations. With oxygen levels in the cases dropping, what happened if the rescue failed, and the young people or rescuers also died - who would be held responsible? As foreigners, they were aware of their vulnerability. What would happen if the day none rescue failed, and boys died – what would this mean for the second attempt? Was there a point at which the team would have to simply leave the remaining boys to die in the caves?

“Sometimes doing something is easier than doing nothing,” said Harris.

Is there a second message in Harris’s experience of this rescue for cybersecurity people? Perhaps it’s that some adversity isn’t always bad for us. Having to confront difficulty, even incredibly dangerous situations, helps to build resilience in the long run. In a very different context, this is something cybersecurity professionals must face on a regular basis, knowing that their failure could sink the entire company. There is also existential risk as well, as anyone defending healthcare will attest.

“A little bit of challenge in life definitely makes us stronger and more resilient. Confronting your fears is a really good thing.”