Interpreting a major event organization's efforts to reliably manage information security risks: the case of the Athens 2004 Olympics

The implementation of mega projects and events is increasingly becoming part of corporate and governmental reality in an effort to create global and frictionless operations and infrastructures that result into a new mobility that has been labelled as 'the most powerful and coveted stratifying factor in contemporary society'. The successful implementation of such mega projects and events usually relies on the highly reliable operations of technological infrastructures and the secure, yet flexible, management of information resources across a number of partnering organizations. However, the past performance of mega projects and events has been greatly criticised for inefficiency, lack of decision-making transparency and an overall lack of diligence with regards to the true nature and extent of associated risks. A need has been identified to investigate more thoroughly the mechanisms employed to manage and communicate risks across a number of vertical and horizontal project and event management dimensions. The objective would be to capture know-how and lessons learned from past experiences in order to support more successful, future mega-project implementations. The aim of this research is to increase understanding of the risk issues and concerns in the management of information systems security (ISS) in a major events context, in an effort to deliver highly reliable IS operations. The study is conducted by reviewing the analysis, design, management and risk communication processes of ISS in the Athens 2004 Olympic Games event. The research methodology adopts an interpretive mode of inquiry, where the management of ISS is longitudinally evaluated in terms of the organizational scope, context and culture, the expectations and motivations of different actors, the meanings assigned to various ISS risk signals and events, and the related patterns of behaviour and organizational actions and controls. The theoretical foundation that informs the collection and analysis of data is that of the Social Amplification of Risk Framework (SARF), which suggests that the experience of risk is determined by the direct physical consequences of a risk/risk event and the interaction of psychological, social, institutional and cultural processes. Findings from the case study under investigation indicate that a major event demonstrates high levels of operational and functional interdependence and complexity, directly or indirectly affecting ISS management efforts, decisions and communications. Principles of high reliability and mindful management can indeed improve overall ISS performance and management of risk, yet the structural and cultural aspects of a major event project will amplify/attenuate risk perceptions and constrain the effectiveness of such controls. Therefore, there is a need to improve understanding of such factors, incorporating this into risk evaluation, management and communication practices. In conclusion, this study shows that the management of IS security and integrity in an environment of great organizational reliability demands requires the appreciation of structural/functional interdependencies and cultural interactions. By sustaining mindful and reflexive processes and structures of risk communication and interpretation, ISS assurance and governance practices will allow organizations to demonstrate that they can reliably anticipate and contain ISS risks.