Beslutningsprosesser i håndtering av en digital hendelse – en Garbage Can tilnærming

IKT16 was a large national exercise where actors practiced on handling a large cyber attack against Norway. The exercise aimed at improving the national ability of managing a large digital event. Several decisions are made during the course of such a large-scale exercise, often with short time frames and with limited information available. In this study, we have examined the processes leading to decisions and the required conditions needed for decisions to be made. The study's theoretical framework is The Garbage Can Model of Organizational Choice (GCM) The model assumes that decisions are made when problems and solutions are paired, and a choice opportunity exists. Moreover, the model emphasizes that the participants in decisionmaking processes have a varying interest in the problem, which in turn affects the outcome. According to the model, participants can also be in a decision-making situation based on coincidence. We consider the reliance on coincidence as an explaining element of participation as a weakness of the model, and we use Stacey and the theory of Complex Responsive Processes to argue that group composition and group dynamics rarely are the result of coincidence. In our view, being able to explain these phenomena strengthens GCM's explanatory power. The study was conducted as an observational study at one of the participating organizations during the exercise. Our findings suggest that especially decisions with medium importance or medium complexity result in Garbage Can-processes. For example, during the exercise the media play introduced events completely different from the cyber attack core of the exercise. The studied organization spent a lot of time following up on one such event. The decision to do so was made by an apparently coincidental group, which really just was the people being around when the event was played. However, the decision to follow up on this sidetrack event did go all the way to the crisis management group. We also found that, although it is meant to be a static and well-defined group, the crisis-management group changed a lot from meeting to meeting. Heavy use of deputies surely influenced the dynamics of the crisis management group. Although we cannot point to exactly if and how this affected the decisions made, we find support in GCM for the supposition that varying participation did in fact affect the decisions in some way. Decisions stemming from Garbage Can-processes are a natural part of every organization. People come together in formal and informal settings making small and big decisions. Human interaction is uncontrollable and can at best be influence by participation. Continuous efforts to build a unified understanding and acceptance of organizational goals may also reduce individual opportunism and personal agendas in decision-making.