thank you there is a town in southern
Iraq sanae-san province that you’ve
probably never heard of the town’s
35,000 people go about their lives much
like you right
they go to the market they meet with
friends over a meal or a cup of thick
black tea they talk the latest gossip
their hopes for the future and they
dream at night it’s how life has been
there for generations the town’s name is
in the jar I’ll come in on the 24th of
June 2003 six flesh army role military
police Redcaps
enter the town to begin the task of
rebuilding the local police station and
training recruits to fit after the brief
war to destroy the infrastructure in the
area these would have been the first
step back to normality and back 10 a.m.
that day they arrived in the town and
they were greeted warming for about
thirty minutes
they shared team of the town elders and
they talked about the best way to return
to effective policing after the
destruction of Saddam’s ruling Baath
Party this was a simple mission this
wasn’t gonna be a hard assignment
military intelligence evaluated the town
and they assessed it as low risk and
benign so low risk and so benign in fact
that the red caps were only carried 50
rounds of ammunition down from the
normal 600 bullets that each one of them
with character and they’ve been provided
only with emergency radios that were
despite this assessment of low risk by
midday just two hours after arriving in
the town
all thick soldiers have been murdered
shot dead huddled in the back room of
the police station they come to rebuild
by a mob armed with automatic weapons so
this event affected me deeply at the
moment they will have Ling in that room
being surrounded by murderous crowd I
was also into southern Iraq I was a
captain in the British Army serving in
the same province serving in the same
brigade as the Red Hat’s after the war
fighting has finished I was carrying out
the role of a military intelligence
officer I met and I served with each one
of the six red caps so of course as you
can imagine I asked myself at how could
this possibly happen when we’ve been so
sure and so confident that the risk was
like how did things end up like this an
initiate I came to the conclusion that
we just got it wrong we missed something
we made a tragic miscalculation we
didn’t understand the area all the
people as well as we thought but even
with the advantage of hindsight I
couldn’t find that thing that we’ve
missed I couldn’t find what we’d
overlooked or misunderstood and standing
here in front of you 13 years later I
can still tell you that the risk of an
armed mob turning on a team of British
soldiers who’ve gone there to help them
to rebuild was alone no question and
even if an angry count had congregated
then they would have told the soldiers
to leave
and told him to never come back to us
there was no way and living killed so in
my soul searching in my question and in
my seeking to understand I had a
realization and I realized that we
hadn’t got it wrong
I realized that tragically we’ve got it
right but we’ve got it right Union
completely flawed system and that flawed
system was the conformity that we
followed and it’s using the system of
risk for as long as people have been
around risk has been our way of dealing
with danger today let’s call this
version one risk operating one device at
a time when things were simple when we
lived in caves and everything’s out
there trying to kill us
whether it be saber-toothed tiger or so
we had to look at everything and stack
them up to understand which one was most
likely to come knocking today so that we
could do something about it
only this way could we survive but with
today’s complexities with the challenges
that we face the speed of human
interaction this model that would be
performing to four generations is no
longer relevant
we need to upgrade from version one risk
operating model to a new version – so
and this is really important kind of
everything on this go forward talking
about that version one risk is the
concept of risk that we all understand
we use every day and that has been
around for generations version two is
red keys some tom was one of the red
caps murdered in the jar alchemy that
day Tom was murdered just four days
before his 21st birthday in his letters
and phone calls home rage remembers that
his son didn’t talk about risk Gregor
and his son spoke about feeling acutely
aware an uncharacteristic disturbed by
his own vulnerability in the chart al
Kabeer
under version 1 risk operating model as
I’ve said there was no question and it
was low risk but any brief soldier in
that town with only 50 rounds of
ammunition and no protection and no
chance of backup was without question
if instead of looking at the risk there
trying to figure out if something could
go wrong which focused on vulnerability
and phrase with those six team members
have ever gone into that town alone
without body armor with no protection
and it’s not just in situations as
tragic life-threatening or an engine of
war where this is true we see the
version one was operating model being
used completely adequately to try and
control today’s complex threats
coroico Bolden was a london-based
trainer when his three-year scam cost
the UBS bank one and a half billion u.s.
dollars in 2011 when he was released
from prison earlier this year he said
that if fights continued to chase the
same level of profitability as in the
past then the only way to generate these
profits is to take more risk to put it
another way banks remain cripplingly
vulnerable to rogue traders despite all
the controls they’re put in place
because they’re happy to accept and are
complacent around risk okay now I do
have a small job for you today I know
you weren’t expecting this as billions
and I understand that it’s it’s a high
pressure on you got there it’s out there
doing good audience in everybody’s eyes
on you don’t worry I’m going to keep it
really really simple and straightforward
what I wanted to do is right now or even
if that’s too much of a challenge just
so I was just talking about how banks
surround themselves with risk despite
the known history with road traders in
the 2008 crash so let’s compare the
bank’s version one approach to Google
and Facebook Google and Facebook embrace
version 2 and actively seek out on the
hood in May this year Facebook a 10 year
old boy in Finland
ten thousand US dollars because he
identified vulnerability in this truck
that made it possible for hackers to
delete the comments from other users
currently Google has a hundred thousand
US dollars up for grabs if you can hack
Chromebook software and expose its
vulnerability Google and Facebook aren’t
looking at the risk of hacking
they are using version two to actively
seek out how its vulnerable to being
hacked under version 1 risk operating
model what we try to do is we try to
calculate likelihood and then we use it
to prioritize risks or to satisfy
ourselves at their control casinos and
banks use the Lorelei’s members to
understand likelihood and then to set
favorable odds if a game is based on the
toss of a coin the likelihood of the
coin landing on heads or tails is
completely objective they can’t be
influenced by human made over time you
toss the coin a billion times it will
land 50% heads and 50% tails and in some
bad news for all you professional
gamblers here with a payout of less than
2 to 1 a house will win that’s why
casino has a chandelier and not a strip
but unlike it unlike a coin people are
unpredictable and inconsistent what
makes the world an amazing place for a
diversity full of challenge and
excitement they’re trying to apply the
law of large numbers to volatile
subjective human behavior it’s
fundamentally for sure and yet this is
what we do on the version 1 risk
ok so favorite color remember a tough
assignment is to write very good yellow
turquoise so using version 1.0 risk
operating system it’s a bit like asking
you all to agree on a collective
favorite color
you’ve got completely diverse opinions
based on your personal taste your
natural biases your upbringing your
culture your history with recent
experiences or whatever and yet this is
what we try to do with our version 1
risk operating under version 1 operating
what we try to do is we try to neatly
put risk into a box or as what we should
be doing is climbing out of the box and
using the version 1.0 risk operating
system or anything involving nature or
people is flawed in the 1960s a version
1 risk assessment soon to be built
Fukushima nuclear power plant defined
that it needs to be able to withstand
the force of a 19-foot tsunami of course
in 2011 a 46-foot tsunami came and
swamped the plant has shown the world
how vulnerable a nuclear reactor could
be in 2003 NASA used the version what
one risk assessment to approve an
authorized net damage to omni shuttle
tragically all seven crew members were
killed when the vulnerability and the
heat proof shield of Columbia’s with led
to it disintegrated on re-entry over
Texas and Louisiana so on each occasion
in those two examples version 1 thinking
fell short and although each event the
tsunami and the disintegration of a
spaceship was exceptionally low risk
Columbia and Fukushima proved to be
heartbreakingly vulnerable version 2.0
the vulnerability model is a healthy
paradox because they focus on one
ability we have to have a deep sense of
paranoia built on a foundation okay so
it’s care and paranoia so it’s like
see within their paranoia from paranoia
we seek out other abilities and from the
vulnerabilities that we find it drives
our paranoia completing the circle and
our version – vulnerability operating
system version 1 with management
operating system is a dangerous paradox
because the more we focus on risk the
more we surround ourselves with us and
the more we surround ourselves with risk
the more comfortable we become so we
need to move away from our preoccupation
with risk just like on the dusty streets
of majare al Kabeer in 2003 it gives us
a false sense of comfort and for
anything more subjective in the toss of
a coin it’s completely full we need to
challenge conformity we need to move
through a version to vulnerability model
and take our vulnerabilities and drive
our natural [Music]