Three weeks after the terror attacks, the Norwegian government appointed an independent commission to study what had happened and to make recommendations for measures to prevent or respond more effectively to future threats. Exactly a year after its creation, on August 13, 2012, the 22 July Commission released its report to the nation. “Every day for a whole year,” the commissioners wrote in the opening paragraph, “we have worked together to find the answers to three key questions: What happened on 22 July? Why did it happen? And more fundamentally: How could our society have let this happen?”
Following are excerpts from the English version of the report:
(from Chapter 1, Introduction with conclusions)
…Our review points out a number of circumstances worthy of criticism and a serious need for change. The deficiencies that we unveiled put society in a less than optimal position to detect and avert plans, and do not enable it to protect against threats as effectively as possible. This led to 22 July not being handled well enough in important areas. It gives particular cause for concern that several of the deficiencies had been pointed out in previous reports from oversight and auditing bodies, without them having been redressed.
Many of the needs for change that we identify as necessary for improving the ability to handle a terrorist attack will also improve the ability to deal with less demanding and more frequently occurring situations. The attack on 22 July was exceptional, and a day unlike any other day, yet the lessons learned are of far broader relevance.
…Against the backdrop of this in-depth overall picture, the Commission has concluded the following:
– The attack on the Government Complex on 22 July could have been prevented through effective implementation of already adopted security measures.
– The authorities’ ability to protect the people on Utøya Island failed. A more rapid police operation was a realistic possibility. The perpetrator could have been stopped earlier on 22 July.
– More security and emergency preparedness measures to impede new attacks and mitigate the adverse effects should have been implemented on 22 July.
– The health and rescue services managed to take care of the injured people and next-of-kin during the acute phase in a satisfactory manner.
– The Government’s communication with the general public was good. The ministries managed to continue their work despite the devastation.
– With better ways of working and a broader focus, the Police Security Service could have become aware of the perpetrator prior to 22 July. Notwithstanding, the Commission has no grounds for contending that the Police Security Service could and should have averted the attacks.
The tragedy of 22 July reveals the need for many kinds of changes: in planning work and rules, in the deployment of expertise and resources, in organizational culture, priorities and focus, and yes, even in the attitudes of society. Some of these changes can be adopted by a government authority. They are the easiest changes to make, as long as there is political will to do so. Other, more fundamental changes – in attitudes, leadership and culture – must be developed over time. For precisely that reason, these might be what deserve attention first.
There is no one single reason that can explain the response – neither what failed, nor what worked. The Commission is nonetheless of the opinion that it has observed that certain basic prerequisites are decisive for the agencies’ performances. Any failures were primarily due to:
– The ability to acknowledge risk and learn from exercises has not been sufficient.
– The ability to implement decisions that have been made, and to use the plans that have been developed, has been ineffectual.
– The ability to coordinate and interact has been deficient.
– The potential inherent in information and communications technology has not been exploited well enough.
– Leadership’s willingness and ability to clarify responsibility, set goals and adopt measures to achieve results have been insufficient.
In the opinion of the Commission, these lessons learned are to a greater extent applicable to leadership, interaction, culture and attitudes, than to a lack of resources, a need for new legislation, organization or important value choices.
Last, but not least: 22 July showed with the utmost clarity how individuals can make a huge difference. The Commission believes that the measures recommended will put society and individuals in a better position to face future challenges. They are inevitable. Accordingly, it is crucial to address the basic challenges. This is urgent.
(from Chapter 19, The Commission’s concluding observations and recommendations)
… It is necessary to repeat that it is the perpetrator and no one else who is to blame for the loss of 77 precious human lives, for physical and mental harm and for great material devastation.
The Commission’s remit has been to assess whether society’s ability to avert, protect itself against and deal with the attacks was good enough, and to pave the way for society to gain knowledge in the wake of the tragedy.
Although a great deal worked well on 22 July, there were failures in important areas. We must strive to retain all the things that worked well, and develop these things further. Where things failed, it is our common responsibility to learn from the failures and make changes….
In connection with its work, the Commission has posed some simple, but fundamental questions on an ongoing basis. First of all: “What happened?” By analyzing documents, making inspections, reading reports, having meetings, examining photos, films, technical data and hearing the explanations of the many involved, the Commission gradually gained a detailed understanding of the course of events. …
This in-depth review has resulted in the Commission concluding the following:
— The attack on the Government Complex on 22 July could have been prevented through effective implementation of already adopted security measures.
— The authorities’ ability to protect the people on Utøya Island failed. A more rapid police operation was a realistic possibility. The perpetrator could have been stopped earlier on 22 July.
— More security and emergency preparedness measures to impede new attacks and mitigate the adverse effects should have been implemented on 22 July.
— The health and rescue services managed to take care of the injured people and next-of-kin during the acute phase in a satisfactory manner.
— The Government’s communication with the general public was good. The ministries managed to continue their work despite the devastation.
— With better ways of working and a broader focus, the Police Security Service could have become aware of the perpetrator prior to 22 July. Notwithstanding, the Commission has no grounds for contending that the Police Security Service could and should have averted the attacks.
… The most important source of learning lies in the Commission’s second main question: Why was the situation handled the way that it was? In reviewing the attack on the Government Complex, we asked the following questions, among others: Why was it possible to park a car outside the H-block? What were the underlying reasons that Grubbegata was not blocked off? Why were more temporary security measures not put into place?
The same applies to the massacre onUtøyaIsland: Why was the perpetrator not stopped before he got to the island? What prevented the police from arriving earlier, and why was that the case?
It has been pointed out that organizations are often unwilling to learn from crises; that they fail to make in-depth evaluations, and that in any case they do not share negative experiences with their surroundings. While the motives may be myriad, one reason might be that embarrassing weaknesses will be uncovered. We perceive the establishment of the 22 July Commission as a sign that the Government and the Storting (Norway’s parliament) seek the opposite, i.e. to learn by understanding the events and the causalities involved. We consider it positive that most of the organizations that were involved in 22 July have gone through their own evaluation processes, shared them with the Commission and made them available to the public. This has made our work easier, but more importantly: We see that the evaluations, despite any weaknesses, have already contributed to a great deal of learning in many government agencies.
… At the outset of our work, we expected that the Commission’s discussions would largely revolve around dilemmas associated with society’s values; about the balance between transparency and security, between trust and control, and between the needs of society-at-large for surveillance and individuals’ freedom and the rights of the individual. These are basic elements to be weighed in a democracy. Dilemmas exist. They are real, and they must invariably be taken into account when society takes a position on new legislation and measures to strengthen civil protection and emergency preparedness. The Commission realizes, among other things, that the democratic costs related to systems intended to eliminate every risk of terrorist attacks are too high. We have to live with a certain level of risk.
In several areas, we see that value choices of great importance had been made with respect to the assessment of the authorities’ efforts: The Government had already made a choice between the values security and transparency when it was decided that the H-block was to be secured against car bombs at the same time as the general public was still to have access by foot. The Police Security Service’s regulations already reflected the balance struck by the Storting between surveillance and the rights of the individual, and this afforded them the opportunity to register the tip about the perpetrator’s procurements. Our review of 22 July shows that these considerations made sense. We can also ascertain that fundamental value choices were not crucial to the outcome since the response was weak.
There is no one single reason in isolation that can explain society’s response – neither for what failed nor for what worked. The Commission is nonetheless of the opinion that it has observed that certain basic assumptions were decisive to the authorities’ performance. Our analysis of 22 July shows that the failures were mainly due to:
– The ability to acknowledge risk and learn from exercises has not been sufficient.
– The ability to implement decisions that have been made, and to use the plans that have been developed, has been ineffectual.
– The ability to coordinate and work together has been deficient.
– The potential inherent in information and communications technology has not been exploited well enough.
– Leadership’s willingness and ability to clarify responsibility, set goals and adopt measures to achieve results have been insufficient.
All in all, 22 July revealed serious shortfalls in society’s emergency preparedness and ability to avert threats and to protect itself from threats….
The ability to acknowledge risk and learn from exercises
Preventing and managing serious incidents in a professional manner assumes that those in charge gain knowledge about the risks they face, and actively adapt their behavior accordingly. Risk awareness helps determine which initiatives are taken and helps determine the dimensions of the security and emergency preparedness that society chooses to have.
Accurate awareness of risk is developed over time by compiling knowledge about the likelihood that various scenarios will arise, and the consequences of different outcomes. It is not easy to be fully cognizant of and implement measures designed to prevent worst case scenarios, and to plan constructive responses to rather unlikely events. Basic security must be in place, and in working with risk, one must not only be cognizant of historical experiences, but also be able to accommodate surprises and uncertainties….
Our review has revealed a number of circumstances where the acknowledgement of risk was not sufficient. Some examples may illustrate this:
– It was underestimated that solo terrorism – where just one person was operating alone – could cause so much devastation.
– The police’s emergency preparedness, also in major crises, is based on the local police district, regardless of size, handling the situation. The operations centers have limited human resources. Despite the fact that experience and repeated exercises have pointed out that this translates into vulnerability, the situation has not changed. The notification and mobilization of personnel are based more on coincidence than on emergency preparedness schemes. This vulnerability has been recognized and accepted, but that has hardly been the case with the risk.
– Despite the fact thatNorwayis a country with a large number of weapons, including high-capacity weapons, the registration of weapons is inadequate, and the weapons control regulations for ownership are not systematically enforced. This means that weapons control is weaker, and the risk level is higher than assumed.
– Despite the fact that international experience indicated a danger of further attacks after the explosion, it took too long to put into place comprehensive security measures or measures to increase the capacity and ability of the police to respond quickly. Helicopters and the Armed Forces’ other resources were requested so late that they did not provide much help for the police operation. Many hours passed before military troops were called out to secure civilian objects. The perpetrator’s contention after his arrest that new terrorist actions had been planned by two other cells, was dramatic. The police sounded a nationwide alarm about this, which few received. The Commission cannot see that any more detailed technical analysis or general discussion were undertaken to determine whether this alleged threat necessitated the implementation of more comprehensive security measures. Instead, people gradually accepted that the probability of new attacks was small. …
The role of coincidence
The outcome of the authorities’ management of 22 July is a result of the actions of individuals and factors related to organization, resources and systems. However, coincidence – good luck and bad – also played a part in the course of events. That will inevitably be the case in a crisis: Unanticipated events and coincidences will to some extent influence how events play out.
Had the bombs at the Government Complex detonated just a few hours earlier, as the perpetrator had planned, many more people would probably have been killed and injured. More than 600 people had been at work in the Government Complex earlier in the day, but almost half had left the area at 3.25 p.m. Had a bomb exploded any other time but during the summer holiday, many of the roughly 3100 people who worked in the Government Complex would have been in danger. It is far too easy to envisage the consequences of such an attack, and the challenges that rescue workers would then have faced….
Society needs to know that it is important to realize that under marginally different circumstances, the consequences of the attacks could have been even more dramatic than the nightmare of 22 July….
Certain coincidences also had unfortunate effects. For example, the Delta force did not come across the caller who offered his boat exactly when they were down at Utvika Camping. There are several examples to indicate that the outcome could have been different with a little luck.
We mention these circumstances because they give pause for thought about both the vulnerability and the robustness of emergency preparedness. But let it be said: Professional security work and good attitudes contribute significantly to mitigating the effects of good and bad luck, and the Commission’s opinion is that most of the observations we have made about the tragedy on 22/7 are not ascribable to coincidence….
By way of conclusion, we would mention two factors that may give pause for both thought and inspiration.
The first refers to the importance of speaking up. It is widely known that many crises could have been averted or handled better if only individuals had expressed their concerns or got involved when they discovered shortcomings or faults. Instead of speaking up, they become passive bystanders, even though they often have valuable information and valuable perspectives that would improve the ability to prevent or manage a crisis. 22 July is, in fact, also a story about the many who knew that critical systems were not working the way they were supposed to, and that measures had not been implemented as planned. It is often the case that in situations in which many observe the same phenomenon, we fail to speak up. Where experts and authorities are involved, there is an extra tendency for many to become passive bystanders. The Commission is of the opinion that reporting risks in one’s surroundings is an important part of an individual’s responsibility to society. 22 July taught us with the utmost clarity that vigilance and engagement can be of the essence, and that it is important that apparently small and perhaps insignificant details or weak signals are given enough attention soon enough.
The second factor refers to personal initiative and engagement. Volunteer organizations are a mainstay ofNorway’s emergency preparedness work. Rarely has the value of voluntary involvement and individuals’ initiatives been demonstrated more clearly than in the moments after the explosion at the Government Complex and on, and on the banks of, the Tyri Fjord on 22 July. Random passers-by, camping tourists and the residents ofUtøyaIslandwere absolutely crucial to one of the most extensive rescue operations ever staged inNorwaythat afternoon. Ordinary people stepped up and made decisions to act. Their efforts were absolutely crucial for the police operation. Without the efforts of the volunteers that day, more lives would have been lost, and the scope of the devastation would have been even greater. Many of these heroes acted with impressive, altruistic effort, putting their own lives in danger. The humanity and zeal they demonstrated, along with what ultimately swelled into thousands of people who, in organized or non-organized form, helped in dealing with the tragedy, should serve as an inspiration as we face the future.
