Recovering from failure: What can security services do to repair trust?

The importance of trust

Trust is of vital importance to organisations; it is essential for maintaining stakeholder relationships and promotes successful organisational functioning. Security agencies, including police forces, rely on trust to grant them legitimacy and to encourage public cooperation and acceptance. This is especially important in relation to the use of systems and practices that can promote public security and safety, but which also have the potential for bias and discrimination (e.g., facial recognition). 
While trust is central to organisational functioning and acceptance, it is fragile and easily lost. There have been numerous, high-profile examples of organisations violating stakeholder trust. For instance, public trust in the US National Security Agency (NSA) degraded in the wake of Edward Snowden’s disclosures about the agency’s surveillance methods. When people lose trust in organisations, those organisations lose legitimacy and public cooperation.

Trust repair mechanisms

In the aftermath of a trust violation, organisations can engage in both short-term and longer-term strategies to repair trust. Short-term strategies can include sense-making and relational mechanisms. Sense-making assumes that stakeholders need to know what went wrong and why it happened for trust repair to take place. This mechanism focuses on providing wronged parties with information that enables them to overcome negative perceptions about an organisation. Specific strategies to enable sense-making include providing explanations, justifications, or denials. 
The relational mechanism asserts that negative emotions caused by the violation must be resolved, and that providing apologies, penance, compensation and punishment can support this process. These acts help establish whether the transgressor has learned their lesson and attempted to make amends with impacted parties. 
Longer-term strategies include the implementation of structural and (in)formal control mechanisms and a commitment to transparency. Structural and (in)formal control mechanisms put in place rules or (in)formal controls that constrain the possibility of future transgressions and untrustworthy conduct. Specific strategies include implementing new policies, codes of conduct, incentives, sanctions, cultural reforms, and regulations. Changing formal structural and regulatory processes, and attempting to instigate cultural change are clearly time-consuming, costly, and difficult, but they are important in that they demonstrate a substantive commitment to change. Returning to the Snowden NSA leaks, the US Government enforced a structural response by passing the USA Freedom Act in 2015 to limit the bulk collection of the telephone data of US citizens by the United States Intelligence Community (USIC).

When trust is lost, taking a comprehensive approach consisting of multiple strategies is likely to produce better results than a piecemeal or reticent approach.

The transparent reporting and sharing of information in the aftermath of a violation demonstrates that the transgressing organisation is behaving in a trustworthy manner. Conducting independent audits and reporting the results, allowing ongoing monitoring, and sharing relevant data are specific actions organisations can take in this regard. For instance, providing transparent access to police data has been proposed as a way to promote trust between the police and the community, particularly when a controversial incident occurs. Giving stakeholders access to statistics allows interested parties to determine how their local police force performs on salient outcomes. In turn, this can support them to make contextually accurate inferences, rather than assuming that a problem in one area is representative of all areas.

No one-size-fits-all approach

The mechanisms and strategies described previously can help organisations repair trust. However, that does not mean that repairing trust is easy. It is inherently complex, as intimated by the variety of cognitive, emotional, and structural processes underpinning the mechanisms. The complexity of trust repair is exacerbated by the fact that a variety of stakeholders have an interest in an organisation’s activities, including employees, customers, suppliers, regulators, and the general public. These diverse stakeholders have different interests, power relations, and expectations about organisations and how they respond to trust failures. Indeed, trust repair efforts may enhance the trust of one stakeholder group but could further undermine the trust of other stakeholders. For example, Siemens’ introduction of strict new rules and compliance requirements in the aftermath of a bribery scandal improved external stakeholders’ trust in the company, but threatened employee trust. As such, there is no single ‘silver bullet’ strategy for repairing trust. What is clear from the literature however, is that a combination of strategies is likely to lead to better outcomes than just one or two in isolation. For instance, a case study analysis of a UK water company’s attempts to repair trust after a fraud scandal found that a combination of practices – including providing an explanation and apology for what happened, paying penance, providing timely and accurate data to the regulator, and engaging in structural and cultural reforms – delivered positive trust outcomes. The company’s early attempts at denial and obfuscation were unsuccessful and further damaged its reputation. 

Summary

Trust is a crucial currency for security services, but it is difficult to maintain and easy to lose. When trust is lost, taking a comprehensive approach consisting of multiple strategies is likely to produce better results than a piecemeal or reticent approach.

Dr Steven Lockey is a postdoctoral research fellow at The University of Queensland. His research interests include how organisations can repair trust after violations and trust in emerging technologies.