I started working on this draft maybe 18 months ago. It was part of a larger project which is still ongoing, but this piece was in decent shape. I wanted to trim it down a lot before I published it, and one of the sections towards the end needs a bit of work too, but since the amnesty is in place (and it's St. Patrick's Day!) I thought I’d give it a few tweaks and lash it up anyway.
This post describes the Lines of Defence risk management structure and explains how it can be applied to pandemic prevention. This is the wireframe of the solution to pandemics (IMHO). We can use these ideas in this post to build the plans and the defensive structures we'll need to protect ourselves from pandemic-potential pathogens (‘PPPs’).
I think this is a novel approach to outbreak control and pandemic risk management. I think the key innovation is the introduction of the concept of strategy: goal-setting, resource management, and contingency planning for different scenarios to ensure the goal is achieved. So the Lines of Defence approach is a strategy that can adapt to the situation on the ground, whereas academic approaches are inflexible and cannot. Indeed, this is one of the major holes in the ‘Swiss Cheese' model of pandemic risk management which, among many other things, will be discussed below.
In short, the Lines of Defence model (capitalised to represent the whole structure and the strategy) helps us to frame the problem, it helps us to build the solutions, and it helps us to communicate the whole process to each other and to the policy-makers and to the public.
So, let's get started...
A line of defence (lower case to refer to the individual line or measure) is anything that can protect you from danger by slowing, weakening, or eliminating the threat. A line of defence could be a policy, a strategy, a system, a piece of infrastructure, or a physical object. Building lines of defence, like adding layers of redundancy, is a common risk management technique, and it should be a key feature of our global pandemic prevention plans.
A wall around a castle is perhaps the most obvious example of a line of defence. If the invaders can’t get past the outer wall, then they can’t harm the people on the other side of it. In this case, the line of defence has successfully ended (or at least, postponed) the threat. A moat around a castle serves the same purpose, and castles often had both walls and moats to protect them. Lines of defence are multiplicative: combining measures offers more protection than employing either measure exclusively.
As I write this, I am looking at an image of a motte and bailey. It seems to me that the whole purpose of the structure is to create multiple lines of defence between the people living within its walls and those on the other side who would do them harm. The bailey is protected by a ditch with a wall on the other side of it. This is the first line of defence. The motte has its own ditch with a drawbridge, and a hill to climb to make it more difficult to get to the top. The keep had another wall around it, as well as its own built-in defences: some were raised off the ground, others were fire retardant. From bailey to motte to keep, the structure appears to be one line of defence after another.
If we stop to think about it for a moment, we can see the lines of defence risk management structure all around us. We use 2-factor-authentication (2 lines of defence) to protect our smart devices. Redundancy is built into elevators, aeroplanes, and other every day engineering works, just in case. The human body is protected from exogenous threats by its external (skin, mucus, eyelashes) and internal lines of defence (stomach acid, the immune system – general and specific). Key infrastructure buildings have multiple rounds of ID checks, scanners, and detectors between the front door and the most sensitive areas. Google’s data centres have 6 lines of defence.
All of these examples are variations of the same underlying protective structure, and they are all motivated by the same idea: the more lines of defence between us and the threat, the safer we will be.
The more lines of defence you have in place, and the higher the quality of each, the safer your position. This principle applies in aeronautical engineering, cyber security, medieval warfare, epidemic control, and wherever else risk is managed.
If you only have one line of defence, and it doesn’t hold, then it’s game over for you. To avoid this ruinous outcome, you need a Plan B to protect your Plan A, and a Plan C to protect your Plan B, etc. If one component fails, and you don’t have a backup, then it’s game over again. So you want spare parts for your spare parts, and more is always better.
The deeper your defences, the more secure your position.
In some cases, the resources required to overcome the successive lines of defence may be so substantial that the defences are never tested. A well-defended castle might encourage the raiders to attack another one instead. The same principle applies to cyber security and home burglary protection.
Finally, in addition to the reduction of actual risk, the structure will also reduce the perception of risk among the population. If there is a strong defensive system in place, and the people know it can be trusted, then it the level of fear and uncertainty in the population will be reduced. This will be especially valuable at the advent of a real emergency when information is scarce, rumours rife, and there is potential for unnecessary panic and social instability.
When faced with a threat of any kind, we want to minimise its potential impact. The farther away it is when we stop it, the less harm it can do to us. So, ideally, we want to stop the threat at our first line of defence because that minimises the risk to our position. In the context of a contagion, we want to stop the PPP as close to its source as possible while the outbreak is small and local, so that they cannot go on to become a global pandemic.
Just as the Lord wants attackers stopped outside the bailey wall (and he certainly doesn’t want them reaching the keep) we want to prevent the PPP from getting anywhere near us. Stopping the PPP with our first line of defence minimises the cost of defence today and it minimises the likelihood that the threat will spill over into civil society at a later date.
If the first line fails, then we want it stopped at the second line. If that fails, then we fall back to our third, etc. The goal is always the same: to stop the threat as far away as possible. We don’t ever want our last line of defence to be tested because if it fails, then it’s game over.
Threats increase over time so, on a long enough timeline, our last line of defence definitely will be tested. If it is tested often enough, then it definitely will fail (eventually). So given that the threats are increasing all the time, our defences should be increasing too – ideally ahead of the threat. The lesson therefore is to keep building more and more lines of defence, and to keep improving the strength and quality of each – especially the outer ones – so that our last lines are never tested.
The Lines of Defence model of pandemic risk management helps us to frame the problem and its solution. It accurately describes what we are trying to achieve with our outbreak response plans and it demonstrates how our public health measures can be employed to achieve those goals. I think most people will intuitively understand the concept, so the model could make it easier to communicate the key ideas in pandemic prevention to policy-makers, media and public alike.
Crucially, the Lines of Defence model brings the concept of strategy into the conversation. It presents goals (stop the threat ASAP), tools (our public health measures), and a sequential / contingent plan for achieving the former with the latter (as described in points 1 & 2 above). Strategy and tactics are essential when solving Risk Management problems because the environment and the risks are constantly evolving and so our tactics need to adjust with them in order to keep the high-level plan on course. Traditional academic approaches to pandemic risk management struggle with this dynamism, as they lack goals and all effects are assumed to be fixed over time.
For example, the ‘Slices of Swiss Cheese’ model currently preferred by epidemiologists does not discern between the timing and effectiveness of measures, nor does it offer any guidance for the timing of their implementation. The Swiss Cheese model is a ‘mash the keypad’ strategy, in which all measures are assumed to ‘work’ and are implemented at the same time for as long as is necessary, to achieve an unstated goal. This approach is not optimal, ambitious, or likely to engender much faith from the public.
Also, slices of Swiss cheese are soft, full of holes, and have never been associated with defence and resilience – for obvious reasons! I think a Lines of Defence is likely to get more buy-in from the public.
This section lists a series of 6 public health measures, each of which can be thought of as an independent line of defence, and which collectively form a simplified ‘Lines of Defence’ pandemic risk management framework.
The first three lines are the most effective at defending our populations from the pathogen and least intrusive on the public. The last three, beginning with lockdown, are the most intrusive and least effective. We want to solve the problem without having to use the latter lines.
This is a high-level categorisation to illustrate the ideas, so it is not complete or final. In the real-world, each line would probably be more like a mini-strategy employing multiple measures, rather than being an individual measure or policy, but this is illustrative and the principles are the same irregardless.
Surveillance is our radar for PPPs: it is always active, constantly scanning the planet for new threats, and it will alert us when a PPP has been identified so that we can respond ASAP. The sooner we discover the outbreak, the smaller it will be, and the easier it will be easier to bring it under control. If the PPP is discovered while the outbreak is still geographically limited, then the threat can be eliminated without impacting the vast majority of the world’s population.
If our surveillance is weak, then the outbreak will have spread further and gained more momentum by the time we discover it. In that scenario, our response will be more complicated, it will consume more of our resources, later lines will need to be activated, and there is a risk that civilian life will be materially impacted. All of this is undesirable, so we should therefore look to implement any measures which can identify the threat sooner.
Surveillance for PPPs includes sewerage testing and environmental sampling. These methods are unintrusive, anonymous, and can function in the background without disturbing the people. Another option is to offer voluntary testing for influenza, rhinovirusus, RSV and other cold or ‘flu-like diseases in local health care facilities. This would help to identify the PPP before any cases have to go to an ICU (which is where the PPPs are often discovered).
A co-ordinated international surveillance system (national collection and international communication) will be one of the key pillars of our future pandemic prevention protocols. It is essential that we expand existing surveillance infrastructure, that we invest in new methods, and that global leaders meet to establish the information sharing agreements needed to build and optimise the system at the global level.
If the global surveillance system alerts us to PPP risk in a foreign country, our first move should be to reduce travel to and from that country (air, rail, road, and foot) until we have greater clarity over the outbreak. On its own, a single bilateral travel ban won’t ensure that a PPP would not enter the country (either directly or via a third country) but it would slow the spread and buy time for domestic policy-makers to handle the outbreak within the public health system.
Hypothetical experiment: what would happen if, on the discovery of a PPP, every country in the world was to implement a border control on the source region? Then no one would be able to get in or out, so the pathogen wouldn’t be able to get in or out. That region would be in isolation – as it should be! One of the oldest principles of contagion risk management is that you strive always to keep the infected (and the potentially-infected) away from the susceptible. Border controls serve the same purpose as isolation and quarantine, the only difference is that they do that job at the global level.
Border controls also benefit from network effects: the more countries use them, the greater their impact. If I import 90% less disease, and I pass on 90% less disease, then my ‘node’ has transmitted 99% less disease overall. If this dampening effect is multiplied across every node in the system, then border controls alone can send the ‘international R0’ towards 0, stopping the global outbreak dead in its tracks. From that point on it becomes a domestic problem for the (hopefully) small number of countries infected, and the rest of the world can send their spare medical resources to help.
Border controls can be extremely effective as an early line of defence, but they must be implemented quickly, they must be targeted at the source region, and they must be co-ordinated internationally. International agreements specifying border control policies during outbreaks of PPPs should be agreed will reduce uncertainty, reduce international political acrimony, and improve the speed and effectiveness our global response. This is a simple co-ordination problem, and it should be solvable. We just need some maturity at the global policy-making level.
If there is a risk that the PPP may be present in our population (ie if we can’t be sure that it’s not present) then we initiate our test & trace program. Testing finds the PPP, contact tracing tracks down the outbreak, and the rapid isolation of contacts cuts all chains of transmission.
The more we test, the sooner we’ll find the PPP and the easier it will be to eliminate it. If the PPP is not present in our population, then every negative test result gives us additional confidence that we are in the clear. A robust test & trace program thereby reduces uncertainty around the epidemiology of the outbreak because we can be confident that it will alert us if and when the PPP is present. Until then, the people can get on with their lives as normal.
Population testing (at departures and arrivals, at health care facilities, in schools, at home, etc) is most easily performed with rapid tests. Contagion is a public health disease and rapid tests are a public health measure: speed, convenience, and volume are worth more than accuracy when testing large numbers of people for contagious diseases. The additional accuracy provided by the Nobel-prize-winning RT-PCR tests may delight the medical nerds, but slow accuracy is little use in a contagion.
We should prioritise rapid mass production of rapid tests at the earliest stages of an outbreak (not rapid production of novel vaccines) so that nations can find out whether the PPP is present in their populations and start taking control of the situation. If we can produce and distribute enough rapid tests early on (of any kind – antigen, LAMP, etc) then we won’t need the vaccines.
A lockdown is an extreme public health intervention, and it should only be used in the most extreme circumstances. In general, lockdown = failure, because if a lockdown is required, then there were policy-making errors earlier in the process which led to the current predicament. That said, there is a time and a place for extreme measures – even within the Lines of Defence approach.
For example, some kind of shelter-at-home order would likely be necessary around the source of the outbreak. Local officials won’t have much information about the nature of the pathogen at the time nor how far it has spread. Given the potential risks for humanity, this obliges them to be especially cautious (we’re doing Risk Management, not Science). In general, the closer you are to the source of the outbreak, the more likely you are to need strict controls on movement and the longer they will remain in place.
If the source region has a local shelter-at-home order in place, plus travel restrictions at city and provincial level, plus a national border closure, then they will have created multiple bubbles (or rings of steel) around the epicentre of the outbreak. This ‘bubbles in bubbles’ effect multiplies the levels of security, and is another example of a Lines of Defence structure in action.
A lockdown could also be justified outside of the source region. Forcing an entire nation into their homes is not a scenario that I wish to explore, but if the threat was a 1-in-a-1,000-year pathogen, and we had reason to believe that the earlier lines of defence would offer insufficient protection, then a swift, strict, pre-emptive lockdown might be justified. To be effective, the lockdown would need to have a clear rationale plus an estimate of its duration which the public could trust. Uncertainty is a cost and extreme public health measures won’t work without the public’s trust.
A lockdown anywhere else or at any other time should be regarded as a failure: a failure to plan, a failure to prepare, and a failure to make the right decisions when we had the chance. To ensure humanity’s long-term survival, we must aim to solve these problems long before we need to consider a lockdown. We can’t afford to let these threats get so close to us. We must be more aggressive.
Mass vaccination should be regarded as a last resort when fighting a PPP. Mass vaccination is neither optimal nor desirable, and its weaknesses as a public health measure during an epidemic should be clear for all to see. The fact that so many in the medical establishment think it our primary and most effective tool beggars belief.
Firstly, if lockdown is failure, vaccination is failure squared. If we need a strict lockdown to stop the pathogen, then we have failed. If it still isn’t enough, and our only remaining option is to design a novel compound, trial it at lower regulatory standards, produce 8 billion doses of it, and distribute them to every corner of the world… then we have failed again. Vaccination should never be necessary; it always signals failure.
Secondly, mass vaccination is at terrible long-term strategy because it means we are always defending ourselves at one of our last lines of defence. Why would we do this to ourselves?! When you’re defending yourself so close to home, the margin of error is smaller, and smaller margins of error are not conducive to survival. I might even go as far as to say that the strategy is guaranteed to fail because nature always finds a way – including a way to evade even the best vaccines (hence the need for more, not fewer lines of defence).
Thirdly, this strategy assumes that we can produce vaccines that are good enough to end the outbreak. That’s a big assumption. It is only when the vaccine has been distributed to the whole population that we will discover its true population effects. What if it’s weaker than the trial data suggested? What then?
Finally, the ethical questions around forced vaccinations with novel compounds are considerable. I would expect serious legal challenges, as well as aggressive opposition in the streets. To push the vaccinations through by granting greater emergency powers, or by neutering dissent in the media will only add to the social discord. Even if we could overcome the logistical challenges, it is difficult to see how a mass vaccination strategy could ever engender the trust and goodwill it would need to be effective.
No. Mass vaccination should only be a last resort in the worst-case scenario.
The ICU is our literal last line of defence. If the ICU can’t save the patient, then the patient will die. It is the line between life and death itself.
There are always calls for greater ICU capacity during outbreaks and bad winters. All else equal, more ICU capacity will save more lives, but expanding ICU capacity in the expectation that it will help us to survive a 1-in-a-1,000-year pathogen is naïve and unhelpful. A highly contagious, highly virulent pathogen will overwhelm every part of the health care system if it isn’t stopped, or at least severely diminished, before it gets there. We need to solve these problems long before they threaten our existing ICU capacity.
From a long-term perspective, every penny spent on ICU capacity is a penny wasted as it diverts resources away from where they could be more effectively allocated (i.e. the earlier lines of defence). Strengthening our last line of defence does nothing to prevent pandemics and will only ever offer us a false sense of security. Invest in ICU capacity in line with your country’s long-term goals, but thinking that it will help protect humanity from pandemics is like thinking that last fibre of rope will hold the rock-climber’s weight: if you’re down to your last fibre, then you’ve already lost.
The previous section gives you an idea of how the Lines of Defence approach could be implemented in an individual country. It addresses the inside view: how we defend our ourselves when we are infected. To understand how the Lines of Defence approach would work at a global level we need to take the outside view: we’ll walkthrough an outbreak in a foreign country from the perspective of a country that is not, presumably, infected.
A full description of a global Lines of Defence pandemic prevention plan is clearly beyond the scope of this post (and the abilities of its author) so this section will present some of the principles that apply, how the process would work, and the kinds of outcomes we could expect.
The closer you are to the centre of the outbreak, the deeper you will need to go into your lines of defence, and quickly too. The further away you are the less you’ll need to do – especially if the countries nearer the source get their responses right.
Pandemic risk management scales. The right principles are the right principles at all levels. An individual should isolate themselves when they are infected, and towns, cities, and countries should too.
The earlier lines in the real-world plan would tend to rely on one set of measures (eg international policy-making) while later lines will rely on others (eg domestic health care infrastructure). No amount of ICU capacity or vaccines can make up for a lack of planning, preparation, and leadership at the policy-making level.
Pandemic ‘best practice’ can be incentivised. If the source region implements the right policies, the rest of the world can send medical resources to fight the outbreak and financial compensation afterwards to cover the cost of it. These costs will be trivial when compared to the costs of failure.
There are network effects to the Lines of Defence approach: the more countries employing this strategy, the more effective it will be. With enough countries are on board, then the PPPs of the future may never leave their source regions.
If everyone is focused on surveillance, and we have data sharing agreements in place, then the world will discover the pathogen while the outbreak is small and localised.
By the principle of scale, the source country goes into isolation and its neighbours (its close contacts) go into quarantine.
The source country will put multiple rings of steel around the source of the outbreak: key buildings/neighbourhoods, the city, the province, etc as appropriate. If it is a city with an airport then all flights should be grounded. It should also reduce international travel along its busiest routs and to major connecting airports (Singapore, Dubai, Amsterdam, etc).
Neighbouring countries will restrict travel to and from the source country. They will implement a large testing program to find the pathogen as it is surely present in their populations. Emergency healthcare capacity should be readied wherever possible. Masking, social distancing, and other societal precautions should be encouraged until we have a clear understanding of the pathogen and its epidemiology.
The rest of the world will take a similar approach to the neighbouring countries, but at a lower level of intensity. Surveillance testing in the population and at ports of entry will be a priority to find the pathogen if it is present and to provide peace of mind if not. Leaders should be getting twice daily briefings on the outbreak. Civilian life continues otherwise as normal.
In short: the source city immediately goes to DEFCON 5, the source country to DEFCON 4, its neighbours to DEFCON 3, and the rest of the world to DEFCON 1. We all stay on high alert, ready to increase our defences if necessary, and ready to lower them once it is definitely safe to do so.
The rapid, targeted, and layered response should all but stop the international spread and smother the outbreak at its source. For all but the most pernicious of PPPs, the combination of early identification, targeted border controls, and robust test & trace programs should ensure that a larger epidemic cannot take hold. Having stemmed the flow at the source, the rest of the world can focus on finding the virus in their populations if present and keeping it out if not.
Neighbouring countries will need to trace down the imported cases and there are likely to be domestic clusters of transmission too. But with no more cases being imported, that should be a manageable task. Some provinces and cities will be more affected than others, but even the worst-affected areas should have transmission under control within a couple of months.
Some cases will have leaked to the EU, the USA and a handful of countries on the other side of the world, but they should be few and BAU for a ready and well-resourced public health service. The public health functions within these countries will remain vigilant until the global outbreak is officially over but the people will continue their lives as normal.
The source country and the source city / province in particular will face the greatest restrictions and for the longest time period. It may be three or four months before the pathogen is eliminated and life returns to normal. That said, the restrictions will be strictest at the start and will gradually ease over the second half of this period.
Overall, the Lines of Defence approach will minimise the risk of a pandemic taking place, while simultaneously minimising the cost of the outbreak, whether measured in cases, lives, health care resources, time, money, or social unrest. For most countries and most people, the threat will be eliminated at their first line of defence, meaning the global problem can be solved while the vast majority of the world’s population is unaware and unaffected.
If we had applied this approach to Covid-19, I think the virus would have been identified in November 2019 and the outbreak would have been over by spring 2020. Such is the power of exponentials and the costs of delay when they are working against you.
The Lines of Defence model is a framework for understanding pandemic risk management in theory and in practice. It establishes our goals, builds our defences in advance, manages the outbreak in the moment, and helps us to communicate our plans and strategies to the public.
If we can identify the pathogen with our early lines of defence (surveillance, border controls, test & trace) then we can eliminate the threat at minimum cost to society, and we will never need to relay on our later lines of defence (lockdown, vaccines, ICU). The later lines are less effective and require severe intrusions into people’s lives, so these interventions are to be avoided wherever possible.
The earlier lines of defence require planning, preparation, and diplomacy from senior health officials and politicians. So the Lines of Defence approach depends on competent policy-making at national and global levels and this, I will admit, is a weakness. However, all plans require competent leadership and if we can get China, the USA, and the EU on board, then most of the hard work is done.
In a linear world, and ounce of prevention is worth a pound of cure, but in an exponential world, it can be worth a tonne of cure - or a thousand! Since prevention and preparation are two sides of the same coin, some competent planning and preparation is all that is needed to improve our pandemic responses by orders of magnitude. Combine that with a Lines of Defence risk management structure, and you should also be able to see that robust, long-term protection from pandemic risk is within humanity's reach.
☘️ Lá Fhéile Pádraig Sona Daoibh! ☘️
