Lessons on Cooperation

We spoke with the president and CEO of the EastWest Institute, Bruce McConnell. McConnell served for four years as deputy under secretary for cybersecurity at the US Department of Homeland Security, and led the International Y2K Cooperation Center (IY2KCC) as its director for the UN and the World Bank.

APC: How did you become the director of the IY2KCC?

Bruce McConnell: In mid-1998 I was serving as the chief of information and technology policy in the US Office of Management and Budget. Y2K preparedness of the US government departments and agencies was a principal focus of my office’s activity. The president had recently appointed a “Y2K Czar,” John Koskinen, who was responsible for coordinating all US preparations. As John got into the issue, he realized that Y2K was a problem that would not respect national boundaries. Working with the United Nations and the World Bank, John and his UK counterpart organized governmental contributions to the World Bank that, along with funding from other countries, created the IY2KCC… the White House seconded me to stand up and run the organisation, where I served until we closed down in March 2000.

APC: What did the IY2KCC achieve?

BM: The IY2KCC did not solve the Y2K problem; it made the work of those who were solving it more efficient and effective. We did so by establishing a global community of people working to remediate the Y2K bug, representing 159 countries and organized along regional and sectoral lines. These subcommunities shared knowledge about what devices were vulnerable to failure and which were not, and about techniques that worked to remediate them. For example, there was concern that elevators might malfunction and drop to the ground. A team based in Germany and Japan investigated elevator control systems and found that only one high-end Japanese system had vulnerability, and that the vulnerability would not cause the elevator to drop, only to stop functioning. We helped the team disseminate this information on a global basis and saved a lot of people time to work on other… vulnerabilities.

Our regional communities were quite successful in identifying interconnections, such as power grids, between neighboring countries. For example, the Latin American group produced the first-ever coordinated map of high-voltage transmission lines in South America, which enhanced cooperation on Y2K, and later, on other power reliability work…

In September 1999, we correctly predicted that the consequences of the bug were likely to be modest. As that report noted, the key issue at that point had become avoiding panic, i.e., reassuring the public that all the work that people around the world had done was sufficient to limit the impact, and that there would be no major crisis. Our work contributed to maintaining a general calm around the crisis, at least for most people.

APC: What would have happened if action had not been taken?

BM: The most serious vulnerabilities were to be found in financial systems. Many governmental and private sector financial systems, including taxation systems, stock markets, and banking transfer systems, had been among the first efforts [of] large-scale computerisation. With software code dating from as far back as the 1970s, many of these systems relied on two-digit dates and… calculations about how much time had elapsed between two dates. Further, the code was often poorly documented and no one actually knew how everything interacted, making the possible impacts difficult to predict.

Without remediation, it was likely that major systems which business and governments depend on to make the global economy function would fail in various ways, either by shutting down, or, possibly worse, by providing unreliable results. In either case, public loss of confidence could have wreaked economic havoc and social unrest.

An example of long-term impact can be found after 9-11. The New York Stock Exchange had developed testing scenarios to validate the functionality of its core systems. When the exchange was closed because of the World Trade Center attack and associate[d] damage in lower Manhattan, the operators brought up the backup site, and used the Y2K testing suites to validate functionality. If those suites had not already been developed, the market would have been done for weeks…

APC: What can be learned from Y2K?

BM: The principal lesson is that, faced with a global threat that cuts across national boundaries and involves every sector of the economy, a successful way of proceeding is to create a loosely-coordinated, cross-disciplinary, global community of people who want to solve the problem, and then facilitate their working together. The IY2KCC worked with all global powers through the United Nations. One can imagine if such a mechanism had been established a year ago, perhaps with the cooperation of major powers and the World Health Organisation, we might be in a better place than we are today.