Nordic Noir: National Risk Assessments in Times of Peace and Pandemics

Again he thought about the senseless violence. The new times, which might demand a different kind of cop. 

We’re living in the time of the noose, he thought. Fear will be on the rise.

From the last page of Henning Mankell’s crime novel Faceless Killers (1991)

The nuclear accident occurs without warning on a severe winter’s morning in February, with snow and biting cold.

Swedish NRA (2016, p. 72)

In a previous blog post, I introduced the phenomenon of ‘all-hazard’ National Risk Assessments (NRAs) and addressed their role in efforts at ‘building back better’ after the COVID-19 pandemic. The post ended with a call for reflection on the foundations and broader consequences of such a move. As a contribution to such reflection, this post looks into the findings, aim and scope of the all-hazard NRAs of Sweden, Denmark, Finland, Norway and Iceland.

In response to a request by the European Union for all-hazard National Risk Assessments in 2010, A summary of risk areas and scenario analyses was published by the Swedish Civil Contingencies Agency (MSB) in 2012 and 2016. The 2016 summary report presents 25 ‘risk areas’ divided into the categories of natural hazards, major accidents, disruption to technical infrastructure and supply systems, and antagonistic incidents. 14 of the risk areas are further elaborated through more specific scenarios.

In Denmark, an all-hazard NRA called The National Risk Profile was published by the Danish Emergency Management Agency (DEMA) in 2013 and 2017. Unlike the Swedish and Norwegian NRAs, it is not centred on individual scenarios but on broader ‘incident types.’ Each type is presented in a chapter on historical examples, characteristics, consequences, actors and a set of brief hypotheticals/scenarios. In addition to 13 incident types, four longer-term trends that are assumed to affect the incidence types are outlined in the last part of the report from 2017.

In Finland, the National Risk Assessment was made for 2015 and 2018. The latter (published in 2019) outlines 24 ‘threat scenarios and disruptions,’ preceded by a chapter on transformations in the security environment. The threat scenarios are not elaborate single scenarios like in the Norwegian and Swedish reports but a description of several potential threats – more like the ‘incident types’ in the Danish report.

The Norwegian Directorate for Civil Protection (DSB) has published assessments of risk scenarios with an all-hazard approach since 2011. Until 2014, the scenarios were collected in an annual report (with an English version called National Risk Analysis in 2014), while the new and increasingly elaborate scenario analyses were presented in separate reports since 2015. In 2019, a new summary report – Analysis of Crisis Scenarios 2019 – was published, with 25 scenarios divided into 16 ‘risk areas’ with 1-3 scenarios per area.

A National Risk Assessment for Iceland was published in Icelandic in 2011 by the Department for Civil Protection and Emergency Management, with an English summary published in 2015. The report covers a wide range of risks and the related vulnerabilities and capabilities, focusing on the exposure of its 15 ‘civil protection districts’. In addition to the 2011 NRA, A Risk Assessment for Iceland: Global, Societal, and Military Factors was published in 2009 by the Ministry of Foreign Affairs in preparation for a new national security strategy.

The latest public all-hazard national risk assessments in the Nordic region.

Nordic risks – Did they see the coronavirus coming?

Overall, the risks included in the Nordic NRAs are largely similar. The three risks that are considered most severe on average are pandemics, nuclear accidents and terrorist attacks (the NRA of Iceland does not rate the risks at an aggregate level). In all the newer assessments, cyber security is an increasingly serious concern across a range of domains, from the disruption of power supply and communication systems, to espionage and political ‘information operations’. Natural hazards, like floods, landslides, storms and wildfires, figure as likely but less severe, except for complex scenarios of more extreme events like a major mudslide in populated areas (Sweden and Norway). Other scenarios, like maritime accidents (Denmark, Norway), earthquake in a major city (Norway) and volcanic eruption (Iceland), figure among the top risks in some countries while being left out of others. Interestingly, the risk of nuclear accidents is deemed at least as severe in the NRAs of Norway and Denmark as in those of Sweden and Finland, although only the latter two have nuclear power plants on their territory.

Summaries from the latest NRAs of Denmark (top) and Norway (below)

Without mentioning the Russian backdrop, Finland’s latest NRA includes ‘foreign political, financial and military pressure’ and ‘the use of military force,’ with the former presented as increasingly likely and the latter as the risk scenario with the highest potential impact by far. The impact of ‘pandemic influenza or similar widespread epidemic’ is rated as limited in comparison to Finland, and lower than, for instance, a terrorist attack. Sweden, Denmark and Norway, on the other hand, have a pandemic on top of their respective lists.

Does this mean that they saw the COVID-19 pandemic coming? Not exactly. They all concentrate on pandemic flu, which is similar in many respects but not as harmful and hard to detect. In addition to mortality estimates, the NRAs emphasise the potential strains on the health system and significant costs from sick leaves. Yet, they do not foresee lockdowns and other drastic measures with disastrous economic and social repercussions. Part of the idea of risk assessments, however, is that preparedness for specific risks also generates preparedness for similar unidentified risks. Clearly, the capabilities that were developed for the management of pandemic flu turned out to be relevant, though insufficient, for handling COVID-19.

Political purposes

The Nordic NRAs are not only meant to support the work of civil protection agencies but to influence political knowledge and practice throughout society. As stated in the Swedish version, the purpose is to inform ‘society’s capability to prevent and respond to disasters at all societal levels’ (p. 9). The Norwegian NRA from 2019 maintains that national risk analyses ‘can create both support and opposing views, but in both cases it contributes to greater awareness and discussion of risk in society’. By increasing ‘the level of knowledge and comprehension of dangers, vulnerabilities and uncertainty’ and ‘thinking through what can possibly happen,’ it is assumed that ‘we will be better prepared to meet disasters when they arise’ (p.20). Therefore, an overall ambition of the Norwegian NRA is not only to help decision-makers prepare for the right risks but to ‘increase their risk awareness’ by changing the very way they think about risk in the first place.

A strong emphasis in Sweden, Finland and Norway on civil-military cooperation (‘total defence’) and comprehensive (‘societal’) security bodes well for the introduction of NRAs as part of national security policies broadly defined (for an overview, see the recent open access book Nordic Societal Security). Following the example of the UK and Netherlands, Finland has now gone all-in and integrated its NRA with its Security Strategy for Society. Here, ‘preparedness’ is defined as the baseline of national security, and ‘the aim is that the national risk assessment should form the basis for preparedness planning at all levels of action’ (p. 25).

In Sweden, there is also direct overlap between the national security strategy and the NRA, but here the main risk assessment document is not the comprehensive summary of risk scenarios but the related annual National Risk and Capabilities Assessment that highlights particular priorities for strengthening national risk management without providing an update on all major risks to society. This assessment is combined with annual public reports and classified communication by specialised security agencies (for background on the focus on risks and threats in Swedish security policies, see the chapter by Stiglund in the above mentioned book).

In Norway and Denmark, there is a clearer distinction between the policy domains of civil protection and foreign and security policy, with the all-hazard NRAs informing the former and annual risk and threat assessments by police and military agencies informing the latter. In Norway, this results in four overlapping national risk and threat assessments, where the all-hazard NRA by DSB focuses on hypothetical risk scenarios while the others concentrate on more manifest threats.

Until recently, the distinction between civil protection and foreign and security policy has been even stronger in Iceland. (As a curiosity, the extensive 2009 NRA for the Ministry of Foreign Affairs that aspired to cover all major risks to Iceland – both civil and military – is only mentioned once in the 2011 NRA for the Ministry of the Interior.) In 2016, a new and more comprehensive national security policy for Iceland was nonetheless introduced, with a paragraph declaring the integration of civil protection into the national security policy (§7). Yet, the two domains are covered by separate security councils and ministries, and no all-hazard NRA has been published since 2011.

The NRAs are not only expected to inform the ‘security ministries’ responsible for civil protection and defence. Like in Sweden and Finland, the Norwegian authorities are formally required to take the results of national and sectorial risk assessments into account through their integration across all fields and levels of government, as specified in these instructions from 2017 (see e.g. p. 15). This does not only imply a broadening of security politics in the sense of overlapping with an ever-wider array of policy domains but a deepening into the regular governance of these domains. The extent to which this objective is realised in practice nonetheless remains a separate question – and The Office of the Auditor General of Norway has repeatedly pointed out fundamental shortcomings in the implementation of national policies of ‘societal security’ (see the report on this webpage, only in Norwegian).

In Denmark, the stated political purpose of the NRAs is more one of raising the general awareness of risk in society and informing risk assessments and exercises by private or public organisations than premising specific governmental policies and strategies. This resembles how the UK National Risk Register directly addresses the citizens as well as the authorities and private corporations (pp. 16-17). Although the NRAs of the other Nordic countries also seek to influence the behaviour of the individual citizen, their reports are presented in a more bureaucratic language suited for indirect rather than direct communication with a wider audience.

Selection criteria

In order to understand why the NRAs identify the risks that they do and why they differ, we need to look into their criteria for selection and assessment. Based on information on their methods in the NRA reports and public background documents, the following sub-sections provide a glimpse into their thematic, geographical, temporal and ecological scopes. Then, the normative premises of the assessments are presented, reflecting the political focus of the assessments.

Thematic scope

The NRAs focus on extraordinary risks within a larger spectrum of risks in a country. This is illustrated in the figures below from the Swedish and Norwegian NRAs. Statistically speaking, the impact of risks like heart diseases, cancer, traffic accidents, poverty and drug abuse on the life and health of the citizens of a state exceed most catastrophic scenarios in the NRAs by far (see for instance the WHO Global Health Observatory, including its data on leading causes of death and disability). Hence, the selection criteria of the risks are not limited to the likelihood and impact of risk types alone – they also include the need for an extraordinary ‘emergency response’ because the events do not happen on an everyday basis.

Figures of scope from the NRAs of Sweden (left) and Norway (right)

Geographical scope

In line with the standard focus of NRAs, all the Nordic NRAs limit their scope to events that take place within the territory of the state (or in its immediate neighbourhood in the case of Finland, and Denmark excludes the Danish territories of Greenland and the Faeroe Islands). Equating ‘society’ with the nation/state, the NRAs of Finland and Iceland (2011, p. 43) draw an interesting distinction between risks of an individual, societal and global kind that illustrates this geographical orientation. Originating from the Finnish Security Strategy for Society from 2010, the threats that primarily concern ‘the individual,’ on the one hand, and ‘the earth and its population’s security in the future’ are exempted from the ‘societal’ focus of the NRA (see the below figures). This idea is also manifest in the equation of the Norwegian and Swedish NRAs of ‘societal’ values with the values of a country.

Illustration of the scope of the NRA of Finland, from the 2018 version, p.22.

Temporal and ecological scope

The NRAs strike an interesting balance between ‘infrequent’ and ‘improbable’ risks in order to be relevant to efforts of prevention and preparedness (see e.g. the NRA of Sweden, p. 12 and of Norway, p. 20). As an operationalisation of this distinction, the NRAs generally follow the EU guideline of focusing on events that may occur within a 5 year period – leaving longer-term risks to a different category of ‘trends’ or ‘tendencies’ (cf. the Danish NRA, p. 6). This means that scenarios that are realistic in the longer run but will take more than five years to develop are excluded, like the risk of a two degree increase in global temperatures or military uses of quantum computing. The Norwegian NRA even demands that ‘the conditions should be present for the events to happen tomorrow’ (p. 20), even if they are only expected to occur e.g. once per 200 years. This criterion of realism is reflected in the focus of Sweden and Norway on ‘realistic worst-case scenarios’ rather than on the most extreme worst-case scenarios imaginable.

Finally, the ecological scope of the NRAs refers animals, plants and ecosystems to ‘environmental factors’. This, for instance, excludes the imminent risk of continued mass extinction of animal and plant species – so-called ‘ecocides’ – as long as it does not have immediate disastrous effects on the welfare of humans.

Normative criteria

According to standard risk management methodology, risk assessments shall ‘reflect the organization’s values, objectives and resources’ (ISO 31000:2018, § 6.3.4). As noted in the previous blog post, this becomes troublesome when the ‘organisation’ is a whole country. The Nordic NRAs avoid defining a set of overall ‘national objectives’ or ‘interests’ that their conceptions of risk are defined by. Instead, they are defined by the more limited security objective of protecting the citizens, resources and institutions of a country. This aim is reflected in specific values and functions to be protected, as a basis for assessing the severity of the risks.

In the Danish NRA, risks are measured in terms of their impact on ‘life, health, environment, economy, property, and vital societal functions’ (pp. 7; 11). In the Swedish version, these parameters are called ‘Swedish national values of protection’ and defined as: ‘human life and health, society’s functionality, economy and the environment, democracy, rule of law, and human rights and freedoms, and national sovereignty’ (pp. 7; 10). In Norway, they are called ‘societal values’ and encompass life and health; nature and the environment; economy; societal stability; democratic values and capacity to govern – all with a set of sub-categories and elaborate indicators (p. 29). Like in Denmark, these values are connected to a set of ‘vital functions in society’.

The NRA of Finland skips the focus on values and goes directly to such ‘vital functions,’ comprising: ‘leadership; international and EU activities; defence capability; internal security; economy, infrastructure and security of supply; functional capacity of the population and services; psychological resilience,’ (p. 10). Iceland’s NRA does not dwell on definitions but assesses consequences in terms of ‘lives and health of the population; the environment; great economic values (property); and great social values – function of society’ (p. 10).

Although this focus on ‘societal values’ and ‘functions’ is formulated in broad and inclusive terms of welfare rather than mere survival, it is surprisingly different from the values declared in the current national security policies of Nordic and other European countries (for a previous analysis, see this report on values in European threat analyses from 2015). For instance, the Swedish National Security Strategy from 2017 (p. 6) maintains that:

Our security is linked to our fundamental values. We will defend and support our democracy and our rule of law and uphold respect for each inhabitant’s freedoms and rights against all domestic and external actors that may seek to undermine them. These values are of inalienable intrinsic value. They constitute the foundation of our society’s prosperity and resilience.

The difference is even clearer in the National Security Policy of Iceland (p.1):

The Government’s national security policy is based on the commitments provided for in the Charter of the United Nations and is guided by the basic values of the Icelandic nation: democracy, respect for the rule of law and international law, humanitarianism and protection of human rights, equal rights for all, sustainable development, and disarmament and peaceful resolution of conflicts.

The exception is the Finnish Security Strategy of Society, which has been aligned with the focus of its NRA on ‘the vital functions of society’. In fact, the only two times that the 101 page strategy mentions ‘human rights’ is as an instrument for addressing global threats in an EU context and in connection with the safeguarding of ‘the system of legal protection’ (pp. 17; 39).

 Science fiction

In line with scenario methodology, the Nordic risk assessments rely on a combination of science and fiction. Indeed, the scenarios presented in the NRA reports can be read as short stories, or ‘plots’, of future disasters. The scenarios forming the basis of the Finnish NRA (see p.12) are produced by ‘writing groups’ in the respective ministries, and in the Swedish and Norwegian NRA reports, each scenario opens with a fictional narrative – like in the scenario on Nuclear accident from the Swedish NRA that was cited in the opening. This is how the ‘chain of events’ in the scenario of a school shooting in the Norwegian NRA 2019 is described:

A 17 year old boy walks into the upper secondary school where he is a pupil in a town in Nordland. The night before he had uploaded a video to YouTube in which he describes how intensely he hates the school that has destroyed his life. He says that he feels rejected by pupils and overlooked by teachers.

He cannot stand the idea of continuing to live like this, and those whose fault it is deserve to die as well. On Monday morning, he walks into a classroom and stands inside the doorway. Here, he pulls a handgun and points it at the pupils in the room. He then fires the first shot.

A teacher in another classroom hears the shot and runs to warn the headteacher, who immediately calls the police. The nearest police station is three hours’ drive away, but there is a district sheriff’s office just nearby where two police officers are normally at work. However, they are on an exercise an hour’s drive away when the headteacher reports the shooting.

After an hour, the sheriff’s office patrol arrives and at about the same time a helicopter lands carrying personnel from the nearest police station. The perpetrator realises he will be arrested and shoots himself. 

Also the Danish NRA includes brief stories – a form of ‘short prose’ – under the heading ‘What if…?’.

Nordic Noir

Altogether, these descriptive, normative and methodological features explain why the Nordic NRAs end up resembling the genre of Nordic Noir. This loosely defined crime genre, with a rooting in Scandinavian realism and naturalism, tends to portray social and political problems in dark and chilling settings. Likewise, reflecting the particular mandates and competencies of the government ministries and agencies producing them, the NRAs equate ‘national risk’ with the risk of exceptional dangers within the territory of a state. Combined with a lack of international and historical comparison, this leaves a disproportionately bleak impression of some of the most secure, peaceful, developed and happy countries of the world (see also the country index in appendix of the World Risk Report 2020). In this setting, the notion of Nordic Noir is itself paradoxical.

Meanwhile, by excluding ordinary risks to the citizens and risks to foreign countries as well as longer-term risks and risks to other species, they leave out some of the main risks that the Nordic countries currently are confronted with. As we have just seen, this ‘plot’ is enabled by the focus on national or societal values rather than on universally defined values that would warrant a global and long-term perspective.

While serving the salient purpose of preventing imminent disasters, the results of the NRAs are therefore problematic if informing the general perception and management of risks throughout society.

I will end on a more poetic note from the last lines of the experimental novel Of Darkness (2013) by the Danish author Josefine Klougart:

We walk to the sea, and in one way we are a form waiting for collapse, in another we are that collapse already, at some other stage. You say a few things about how the war will proceed. How we should act. The crystallisation that is forever going on. Protest against the basic conditions, the refusal to even accept such terms. Everything else is madness, and worse: futile, without will. 

And then again: the light of morning.