Blog

Don’t underestimate one in a hundred year events…..

That’s the key message from the recent flooding disaster in Texas on the 4th July holiday weekend and the stark warning for Australian planners and policy makers. What happened around the Guadalupe River in Kerr County, was catastrophic from dual perspectives of loss of life, and, the failure of preparation and warning procedures. It should highlight to us in Australia, that even in this era of social media and hyper- connectedness, with many learnings from past disasters, we’re still prone to being beaten by the elements. In Texas, the combination of natural events, the physical environment and human failures stacked the odds overwhelmingly against not only campers, hikers and people on the roads, but people just sitting in their homes. Harrowing stories are coming out about people sitting in houses washed off their foundations. Such failures to alert and assist these people and obvious flaws in planning and systems points to a need to ensure that our Australian emergency tools and processes are ready. Australian policy makers and governments will be getting briefed on what happened in Texas, not only on what happened in terms of planning, warnings, preparation, but also a more specific analysis of what sites and terrain match the perfect storm of geography, slope, soils, creek confluences, narrow gorges, rainfall funnels, dry soils. This article takes a high level look at some of the issues.

The obvious starting point would be immediately reviewing the traditional 1-in-100+ methodology of quantifying risk and allocating resources. It’s clear that climate related disasters are happening more often.

In relation to the recent disaster in Texas, you might wonder why people were sleeping in tents, sitting in their homes, driving in their cars, while record levels of rainfall, and torrents of rainwater were churning down multiple creek beds funnelled into the gorges in the Guadalupe River on a obvious collision course. People simply didn’t know the size of the catastrophe.

Here are some key learnings for Australia:


🇦🇺 🔍 1. Don’t underestimate 1-in-100 flood risks in rural and hilly terrain in Australia

Australia’s Great Dividing Range, Blue Mountains, Victorian Alps, Far North QLD, and Tasmanian highlands share key characteristics with Texas Hill Country:

  • Impermeable soils and steep terrain
  • Sudden convergence of creeks into narrow river systems
  • Growing peri-urban development in hazard zones

➡️ We need more detailed flash flood modelling, GIS-based hazard overlays, and localised evacuation triggers based on real topography, not just postcodes. Here are some examples of risk sites, from a basic AI screening:

a. Shoalhaven River, NSW (Kangaroo Valley – Tallowa Dam – Nowra)

  • 🏞️ Steep upper catchment in Morton National Park and Budawang Ranges
  • ⛺ Numerous campsites near Kangaroo Valley and Yalwal and Coolendel
  • ⚠️ Known for fast river rise, limited warning downstream in Nowra

📍Comparable to Guadalupe River’s upper forks and hill terrain


b. Macquarie River & Fish River, NSW (Bathurst – Hill End – Wellington)

  • 🏞️ Steep gorges (Macquarie Pass, Fish River Gorge)
  • 🛶 Popular for camping/fishing
  • ⚠️ Flash floods possible when tributaries rise in isolation, especially above Bathurst

📍Similar to mid-river zone of Guadalupe, with junction dynamics


3. Barrington River & Gloucester River, NSW

  • 🏞️ Very steep terrain in Barrington Tops NP
  • 🌲 Fast-flowing rivers with confluences near Gloucester
  • ⛺ Multiple riverside cabins + farm-stay tourism operators

📍Similar to Camp Mystic zone — remote riverside accommodation downstream of gorges


c. Ovens and Buckland Rivers, VIC (Bright – Porepunkah – Harrietville)

  • 🏞️ Steep alpine catchments in the Victorian Alps
  • ⚠️ Rapid storm runoff → flooding in Bright and along Ovens River
  • 🏕️ Many holiday parks, riverside walks, and schools camps

📍Similar to Guadalupe tributaries near summer camps


d. Broken River, VIC (Delatite – Mansfield region)

  • 🏞️ Steep terrain, narrow valleys near Lake Nillahcootie
  • 🛶 Popular for outdoor education camps and kayaking
  • ⚠️ Confluence zones prone to rapid flooding

e. Fitzroy River, QLD (Carnarvon Gorge – Rockhampton)

  • 🏞️ Steep gorges upstream in Carnarvon NP
  • ⛺ Tourists and bushwalkers often unaware of rainfall upstream
  • ⚠️ Flash floods possible from upstream rain not visible locally

📍Risk: Sudden river rise in dry weather = dangerous camping


f. Bellingen & Never Never Rivers, NSW

  • 🏞️ Tributaries from Dorrigo Plateau → steep descent into gorges
  • ⛺ Prominent riverside campsites and swimming holes (e.g. Promised Land)
  • ⚠️ Fast runoff and poor phone reception = dangerous flash flood profile

🔍 Summary of risk factors:

FeatureRisk Factor
Creek confluencesMultiplying discharge rapidly
Narrow gorgesSudden rise and surge effect
Steep terrainFast runoff, no absorption
Upstream national parksRainfall may be unseen downstream
Downstream tourismCampsites, cabins, low situational awareness

⚠️ 📢 2. Warning Systems Must Be Universal, Not Opt-In

In Texas:

Local authorities relied on an opt-in app (CodeRED) and failed to activate the national IPAWS system — many campers and residents got no warning at all.

In Australia:

  • We rely on text alerts, RFS apps, and media, but there is fragmentation between states and LGAs.
  • Not everyone uses apps like Hazards Near Me or VicEmergency.

➡️ Australia must ensure that:

  • Emergency alerts are mandated at the national level
  • Redundancy exists across SMS, radio, TV, apps, and satellite messaging
  • Geo-targeted alerts are tested and mandatory for local councils

🏕️ 🎯 3. Holiday Period Risk Must Be Actively Managed

In Texas:

The flood hit during the Fourth of July holiday — campsites, cabins, riverside properties were full of people unaware of the danger.

In Australia:

  • Bushfires, storms, and floods peak in holiday season (Dec–Feb)
  • Coastal and inland camping hotspots (e.g. Shoalhaven, Snowy Valleys, Otways) are highly exposed

➡️ Australia needs:

  • Proactive seasonal risk bulletins
  • Localised hazard dashboards for visitors
  • Integration of hazard alerts into tourism platforms, Airbnb, and campground booking systems

🛰️📡 4. Geospatial Risk Mapping Must Be Open and Usable

Texas had fire and flood data — but the visualisation and communication of risk was lacking. Maps were not integrated into decision-making in real time.

Australia has:

  • Good geospatial hazard data (NSW SEED, QRA Flood Viewer, VicGov’s Fire History layers)
  • But still lacks real-time, citizen-facing GIS tools for:
  • Address-based risk summaries
  • Evacuation zone overlays
  • Live rainfall + river telemetry in one place

➡️ There’s a major opportunity for:

  • Public-facing risk dashboards using AI + GIS
  • Interactive evacuation planning tools per LGA
  • Open-source address-level hazard reporting tools (especially for rural councils)

🌡️🌪️ 5. Climate Amplification Is Here Now

The Texas flood was supercharged by:

  • Warm Gulf air → extreme moisture
  • Drought-hardened soil → more runoff
  • Increased storm persistence due to atmospheric blocking

Australia faces the same pattern:

  • La Niña years = east coast flood clusters
  • Hotter atmosphere = heavier rainfall per storm
  • Drought → Fire → Storms → Floods (in a destructive cascade)

➡️ Every hazard planning document and infrastructure design code must now include climate-amplified scenarios.
That means:

  • Shorter return periods for “1-in-100-year” events
  • More flexible evacuation planning
  • Dynamic, scenario-based emergency simulations

🧠 Final Takeaways

Texas LessonAustralian Response
Opt-in warning failedMandate cross-platform alerts
Terrain amplified floodsUpdate flood models for steep catchments
Holiday timing worsened impactIntegrate hazard comms into tourism systems
GIS underusedBuild citizen-ready hazard dashboards
Climate intensified rainfallPlan for compound, not isolated, events

Comparative Analysis of Global e-Waste Policies

1. The e-Waste Problem: Scope and Urgency

What is e-Waste? Electronic waste (e-waste) includes discarded electrical and electronic equipment (EEE) such as computers, televisions, mobile phones, appliances, and data centre hardware. These items often contain toxic materials (lead, mercury, cadmium, flame retardants) and valuable resources (gold, silver, rare earths).

Why it is a Problem

  • Environmental harm: Improper disposal can lead to soil and water contamination.
  • Health risks: Exposure to hazardous substances poses threats to human health, especially among informal waste workers.
  • Resource loss: Recoverable materials worth over USD 60 billion are lost annually.
  • Data security: Devices often contain sensitive data that, if not securely erased, could lead to breaches.

Scale of the Problem

  • In 2022, global e-waste generation reached 62 million tonnes (Mt).
  • By 2030, it is projected to grow to 82 Mt.
  • Only ~22% of this waste is formally collected and recycled.

2. Methodology: Comparison and Ranking Framework

To evaluate national and regional e-waste policies, we use the following criteria:

  1. Policy Comprehensiveness: Scope of products covered by legislation.
  2. Extended Producer Responsibility (EPR): Obligation on producers to manage end-of-life disposal.
  3. Collection & Recycling Rates: Official data on performance.
  4. Enforcement & Oversight: Legal framework and compliance mechanisms.
  5. Innovation & Infrastructure: Technological and process-based responses.
  6. Transparency & Data Reporting: Regular, verifiable reporting.
  7. Data Sanitisation Policies: Regulations governing secure erasure of sensitive data.
  8. Data Centre Specific Policies: Inclusion of servers and infrastructure in waste and data governance.

3. Comparative Analysis

See end of document for acronyms used.

Country/RegionEPR & Product CoverageCollection RateData Sanitisation RegulationData Centre ProtocolsEnforcementComments
EU (Germany, France)Mandatory WEEE, all EEE~42%GDPR mandates secure erasureGuidance under EU waste and cybersecurityStrongModel framework, high compliance
UKWEEE and DPA~40-45%UK DPA enforces secure data destructionNHS and DEFRA-aligned data centre policiesStrongInnovation (e.g., Royal Mint e-waste plant)
USAState-level EPR, sectoral lawsVaries (5-35%)NIST 800-88, HIPAA, GLBAR2/e-Stewards common in data centresMediumStrong certification, patchy federal law
CanadaProvincial EPR (EPRA etc.)~30-40%PIPEDA requires protection, no national e-waste erasure standardProvincial guidesMediumSome harmonisation through EPRA
AustraliaPartial EPR (TVs, computers)~54% collected, <20% recycledNo national data erasure lawsVoluntary NABERS Waste rating, no mandatory ITADWeakLacks mandatory scope, no uniform policy
New ZealandPriority product declaration~2-3% recoveryPrivacy Act requires safe disposal but not enforcedNo official ITAD policiesVery WeakMinimal recycling infrastructure

4. Australia’s Policy Landscape: Strengths and Deficiencies

Strengths

  • National Television and Computer Recycling Scheme (NTCRS): EPR covers computers and TVs.
  • Export Restrictions: Australia has banned the export of unprocessed e-waste, aligning with the Basel Convention.
  • State Landfill Bans: Some states (e.g., Victoria, SA) ban e-waste in landfills.
  • NABERS Data Centre Waste Rating: Voluntary tool for sustainability metrics.

Major Gaps

1. Limited Product Scope

  • NTCRS only covers TVs, desktops, laptops, printers.
  • No inclusion of small household appliances, mobile phones, servers, or solar PVs.

2. No National Standard for Secure Data Erasure

  • Australia lacks a dedicated federal mandate requiring certified data erasure for IT equipment.
  • The Privacy Act 1988 provides general obligations to protect personal information, but it does not prescribe technical standards for data destruction.
  • Australian Prudential Regulation Authority (APRA) Prudential Standard CPS 234 requires regulated entities to manage information security, but compliance enforcement and data destruction procedures remain ambiguous.
  • Australian Signals Directorate (ASD) offers the Information Security Manual (ISM), which includes guidance on media sanitisation but is only mandatory for government agencies.
  • Australian Security Intelligence Organisation (ASIO) and other national security stakeholders recommend destruction protocols but offer no enforceable national standard across the private sector.
  • There is no requirement for tools like Blancco or compliance with NIST 800-88 or ISO/IEC 27040.

3. Data Centres Unregulated at End-of-Life

  • No mandatory requirement for data centres to follow certified ITAD processes.
  • NABERS Waste for Data Centres is voluntary and lacks enforcement mechanisms.
  • The Security of Critical Infrastructure Act 2018 (SOCI) mandates cyber and physical risk management for critical infrastructure, but does not yet mandate certified end-of-life IT disposal or sanitisation.

4. Fragmented State-Level Approaches

  • Landfill bans and e-waste handling rules vary significantly by state.
  • No unified national standard or framework ties together states under a consistent operational model.

5. Reporting and Oversight

  • No national register of e-waste processors, recyclers, or ITAD providers.
  • No public transparency or compliance reporting regime equivalent to EU registers.

5. Best Practices & Global Leadership

World Leaders

  • Germany: Robust EPR, recycling targets, and data governance.
  • UK: Enforces data destruction, high transparency, innovative recovery.
  • France: Strong market compliance and regulatory tools.
  • USA: Strong sectoral enforcement and use of certified ITAD.

Innovations

  • Royal Mint (UK): Recovers precious metals from PCBs.
  • Greenbox/Excess (Australia): Voluntary ITAD services with certifications.

Key Lessons

  • Integrate data security and environmental protection in law.
  • Mandate data centre e-waste handling.
  • Use certification (e.g., ISO 27001, R2) as compliance tools.

6. Recommendations for Australia

  1. Expand NTCRS Product Coverage
    • Include mobile phones, small devices, servers, modems, PV systems.
  2. Mandate Secure Erasure
    • Amend Privacy Act and critical infrastructure rules to require certified sanitisation.
    • Use NIST 800-88 or ISO/IEC 27040 as baseline.
  3. Enforce ITAD in Data Centres
    • Make NABERS Waste certification mandatory.
    • Require device-level tracking and sanitisation logs.
  4. Unify State Landfill Policies
    • National coordination on landfill bans for all e-waste.
  5. Create a National Reporting Platform
    • Public, real-time data on recycling volumes, erasure compliance, and audit results.

7. Conclusion

Australia has foundational e-waste and privacy laws but lags significantly behind world leaders in scope, enforcement, and integration. To prevent environmental degradation, data breaches, and economic waste, Australia must modernise its policy framework and hold producers, recyclers, and data centre operators accountable.

The convergence of e-waste and cybersecurity regulation is not just best practice—it is essential for Australia’s transition to a secure, circular economy.

AcronymFull Term
EPRExtended Producer Responsibility
EEEElectrical and Electronic Equipment
WEEEWaste Electrical and Electronic Equipment
GDPRGeneral Data Protection Regulation
DPA (UK)Data Protection Act (United Kingdom)
NHSNational Health Service (UK)
DEFRADepartment for Environment, Food and Rural Affairs (UK)
HIPAAHealth Insurance Portability and Accountability Act (USA)
GLBAGramm-Leach-Bliley Act (USA)
NISTNational Institute of Standards and Technology
PIPEDAPersonal Information Protection and Electronic Documents Act (Canada)
ITADIT Asset Disposition
NABERSNational Australian Built Environment Rating System
NTCRSNational Television and Computer Recycling Scheme
PVPhotovoltaic (solar panels)
ISOInternational Organization for Standardization
MtMillion tonnes
R2Responsible Recycling Certification
PCBPrinted Circuit Board
ISO/IECInternational Organization for Standardization / International Electrotechnical Commission

References

  • UN Global e-Waste Monitor (2024)
  • PwC Australia e-Waste & Data Risk Report (2023)
  • NABERS Data Centre Waste Guide (2024)
  • Australia Department of Climate Change, Energy, the Environment and Water
  • Iron Mountain Secure ITAD Australia
  • Blancco Global Data Erasure Study (2022)
  • WHO e-Waste Fact Sheet
  • Basel Convention Implementation Reports

The White Island Volcano Disaster: A Tragedy of Nature and Negligence

Another post in the risk series, this time we review the catastrophic risk failure at White Island, New Zealand, in 2019.

Where is White Island?

White Island—known as Whakaari in te reo Māori—is located in the Bay of Plenty, approximately 48 km off the east coast of New Zealand’s North Island. It is the emergent summit of a larger submarine stratovolcano and represents the country’s most active cone volcano.

Privately owned by the Buttle family, the island was the focus of adventure tourism for decades. Visitors reached it by boat or helicopter for guided walking tours through its steaming crater, often just metres from active vents. Despite its remote and volatile nature, White Island was promoted as a “bucket list” destination—its danger forming part of the attraction.

What Kind of Volcano Is It?

Whakaari is a stratovolcano that has produced frequent phreatic and magmatic eruptions. Its activity is dominated by steam-driven explosions caused by groundwater flash-boiling upon contact with hot rock or magma, ejecting ash, rock, and gas without any visible lava flow.

The volcano’s eruption history includes:

  • 1914: A collapse at the crater rim triggered a lahar, killing 10 sulfur miners.
  • 1980s–2010s: Frequent minor eruptions, crater lake activity, and gas emissions.
  • 2012–2016: Series of explosive events, some damaging monitoring equipment.
  • By 2019, the volcano was in a state of persistent low-level unrest, monitored by GNS Science via GeoNet.

What Happened on 9 December 2019?

At 2:11 PM on 9 December 2019, White Island erupted suddenly, without warning. A group of 47 people—including international tourists and local guides—were on or near the crater floor at the time. The eruption was phreatic, ejecting superheated steam, ash, toxic gases, and rock fragments at high velocity.

  • 22 people died either immediately or later from burns and respiratory injuries.
  • 25 others were injured, many suffering burns to over 80–90% of their bodies.
  • The force and suddenness of the eruption meant there was no time to escape or take shelter.
  • Rescue efforts were delayed due to the high risk of follow-up eruptions.

Key Failures That Led to the Disaster

The disaster was not just an act of nature—it was the result of several institutional, operational, and regulatory failures. These include:

1. Inadequate Interpretation of Geological Risk

GeoNet had raised the volcanic alert level to Level 2 in the days before the eruption, indicating “moderate to heightened volcanic unrest.” This alert came with increased gas emissions and tremors—but no mandatory closure or suspension of tourism.

Despite this, no effective decision-making framework existed to translate the alert level into a “no-go” decision for tours. Operators and regulators alike treated these alert levels as informational rather than actionable.

2. Regulatory Gaps and Fragmentation

There was no clear statutory authority empowered to shut down tourism on Whakaari during heightened risk periods. Multiple agencies were involved (GNS Science, WorkSafe NZ, Maritime NZ), but no one entity held the mandate or took responsibility for visitor safety decisions.

This diffusion of responsibility left decisions up to individual tour operators—even though many lacked the technical capacity to assess volcanic risk on their own.

3. Inadequate Risk Assessment by Tour Operators

WorkSafe investigations found that key operators had no comprehensive, updated risk assessments, and lacked detailed hazard mitigation plans for phreatic eruptions.

Examples of failure include:

  • Tour companies continued operating even with recent increases in gas and tremor activity.
  • Visitors were not provided with protective gear (e.g. respirators, fireproof clothing).
  • No formal evacuation training or procedures were in place.
  • Risk disclosures were minimal or misleading.

4. Commercial Pressures and Normalisation of Risk

Over time, the absence of major incidents despite visible volcanic activity created a false sense of safety—a classic case of the “normalisation of deviance.” Tour operators grew accustomed to operating in high-risk conditions without consequence, leading to complacency.

Moreover, Whakaari tourism was a lucrative business. Thousands of cruise ship passengers visited each year, and the economic incentives to continue operations often overrode caution.

5. Emergency Response Shortcomings

  • The rescue delay (approximately 1–2 hours) was partly due to risk to rescuers—but also due to lack of planning for worst-case scenarios.
  • There was no real-time monitoring team on the island or contingency plan for rapid evacuation.

Learnings and Changes After the Disaster

The Whakaari eruption forced New Zealand to reassess how it manages high-risk geotourism and natural hazards. Key outcomes include:

  • Criminal charges under the Health and Safety at Work Act 2015 were laid against 13 organisations and individuals, including Whakaari Management Ltd and tour companies.
  • WorkSafe investigations found that owners and operators breached duties to ensure the health and safety of workers and visitors.
  • White Island tours were suspended indefinitely, and the site is now closed to the public.
  • Risk levels associated with geotourism have been reclassified, with greater weight given to scientific alert systems and mandatory responses.
  • Public and private sector bodies now place a stronger emphasis on independent risk validation, conservative thresholds, and pre-emptive closure policies.

What Are the Broader Risks?

The White Island disaster illustrates the high-consequence nature of phreatic eruptions—sudden, violent, and with no reliable precursors. From a geotechnical perspective:

  • Standard monitoring systems often fail to predict phreatic events.
  • These eruptions can happen without magma movement, making traditional seismic forecasting tools less effective.
  • Tourist sites near volcanic vents, geysers, or hydrothermal systems must be treated with extreme caution.

Summary from a Risk Manager’s Perspective

From a risk management viewpoint, the White Island disaster reveals systemic breakdowns in hazard-to-decision conversion, particularly in adventure tourism:

  • Hazard awareness was high, but action thresholds were absent or ignored.
  • Responsibility was fragmented, with no one clearly empowered to halt operations.
  • Risk assessments were static and failed to adjust to real-time changes in hazard profile.
  • Commercial imperatives conflicted with safety imperatives, and there was insufficient oversight to prevent unsafe practices.

Conclusion

White Island was always dangerous. What turned risk into tragedy was not the eruption itself—but the failure to act on clear warning signs, the lack of coordinated governance, and the prioritisation of commercial interests over safety.

The disaster is a stark lesson in what happens when systems treat known risks as tolerable because nothing has gone wrong—yet. In high-risk environments, the absence of past incidents does not mean safety; it simply means luck has held. For risk managers, regulators, and policymakers, Whakaari is a painful reminder that failing to plan for low-probability, high-consequence events is itself a form of negligence.