Sea-Tac’s handwritten boarding passes were a staffing plan in disguise

The week

On August 24, 2024, at Seattle-Tacoma International Airport, many of the systems the airport depends on went dark.

That day the Port of Seattle, the public agency that runs Sea-Tac, detected a cyberattack and isolated parts of its network. Isolating a network means deliberately cutting connections between computers so an attacker cannot spread further, much like closing fire doors in a building. It contains the damage, but it also switches off whatever relied on those connections.

The outage hit systems the Port operates, including websites, email, phones, Wi-Fi, terminal screens and the baggage sorting system. Some airlines at Sea-Tac use shared, or “common-use,” gates and check-in counters that run on Port software rather than each airline’s own. When that software went down, those airlines lost their tools too.

What followed was a scene few travelers had seen. Over the next days, agents at common-use gates that rely on Port software handwrote boarding passes. Alaska Airlines staff sorted thousands of bags by hand. Travelers using the common gates were told to arrive three hours before departure.

Most problems were resolved within days, but not all. Flight information displays, the large screens that tell passengers where and when to board, returned only in mid-September. The airport website and app were still down three weeks after the attack.

In mid-September the Port attributed the attack to the Rhysida ransomware group and said it would not pay. Ransomware is criminal software that locks up an organization’s computer systems and files, often after first copying data out, and the criminals then demand payment to unlock the systems or to keep the stolen data private.

The timing sharpened attention. The incident came about five weeks after the faulty CrowdStrike update that disrupted Windows systems worldwide, so operational resilience was already in the headlines. Twice in one summer, the public had watched essential services discover how much of their daily work ran through technology, and what happened when it stopped.

The pictures from Sea-Tac were striking because they looked old-fashioned: agents writing boarding passes by hand, staff sorting bags by hand, travelers in long lines told to arrive hours early. They showed something every public leader should take to heart. A public service does not stop when its systems do. It turns into a manual operation, run by staff who may never have done the work by hand.

How well that goes is decided long before the incident, mostly by workforce choices rather than technology.

Almost every agency continuity plan contains the phrase “revert to manual procedures.” It is reassuring to read and easy to approve. But the phrase hides four questions that follow the life of an outage: what can run manually, who runs it, how long it can last, and how the agency returns to normal. They are sequential and distinct. A plan that answers only the first is a list.

How ransomware turns an IT problem into an operations problem

The four questions follow from what ransomware actually does to an organization.

Modern ransomware attacks usually unfold in stages. Criminals first get a foothold, often through a stolen password, a phishing email or an unpatched system. They then move unnoticed through the network, looking for valuable data and for the systems whose loss would hurt most. Frequently they copy data out before doing anything visible. Only then do they trigger the encryption that scrambles files and locks systems, and present a ransom demand.

This produces two separate crises. One is operational: systems stop working, and the organization cannot do its job the usual way. The other is a data breach: personal or sensitive information has been stolen and may be published or sold. The first is loud and immediate. The second is slow and less visible, and it often lasts longer.

There is a further twist. The safest immediate response, isolating parts of the network, is itself disruptive. Leaders should expect that their own security team, acting correctly, will switch off services to stop the spread. A continuity plan therefore cannot assume that only the “infected” systems will be down. It must assume that whole groups of connected services, from email and phones to screens and specialized equipment, may be unavailable at once, for an unknown period.

So “revert to manual” is a staffing plan more than a technology plan. When the systems are gone, what remains is people, paper and whatever was prepared in advance.

What can run manually

Some processes have a workable paper version. Others have a degraded version, and some simply stop. Boarding passes can be written by hand, and bags can be sorted by hand. A permit office can take applications on paper but cannot check eligibility against a database it cannot reach. A 911 center can log calls on cards, but only if the cards exist.

The useful artifact is a service-by-service list, built with the people who do the work, that marks each function as manual, degraded or stopped. For each manual function it should name what must exist in advance: printed forms, offline copies of reference data, staff contact lists, cash handling procedures, radios and physical supplies nobody has ordered in years.

It should also show hidden dependencies. A paper process that still relies on the phone system, a payment processor or a partner agency’s database can fail for reasons unrelated to the agency’s own network. A clerk ready to take paper applications is stuck if she cannot call a supervisor because the office phones run over the same network that has just been isolated.

Shared services, such as a county IT department supporting many offices or a port running common-use systems for many airlines, concentrate this risk, because one outage stops many tenants at once. That is exactly what happened at Sea-Tac’s common-use gates: airlines that had done nothing wrong lost their tools because the shared platform went down.

A county permits office, function by function

Take a county permits office. Its list might show that over-the-counter building permit applications can be taken on paper (manual), that zoning checks can be done only for parcels covered by a printed map book last updated years ago (degraded), and that online payment is unavailable (stopped). The plan would then name what each needs: a stock of numbered paper forms, a current offline copy of zoning maps, a cash and check procedure with a locked box and a log. Nobody can produce those on the morning of the outage.

Who runs it

Manual work needs more people. A step a system did in a second takes a minute by hand, and every queue lengthens. Staff must be redeployed from functions that have stopped, and they need to know where to report and what to do.

Here plans usually stop being specific. Job descriptions, collective bargaining agreements and contractor scopes may not cover the work people are suddenly asked to do. Back-office staff may need to face the public. Supervisors need clear authority to reassign people across units.

Agencies that have agreed these terms with employee representatives in advance avoid a dispute in the middle of an incident. A practical device is a short pre-agreed “incident duty” clause, plus a roster of staff trained in each manual procedure, refreshed annually and tested in drills where frontline staff actually perform the work. A tabletop exercise in a conference room, where managers talk through a scenario, is useful but not enough. Someone has to hand-write a hundred boarding passes, or sort a cart of mail by hand, to find out how long it takes and what goes wrong.

Contracted staff need the same planning. At an airport, many of the people at the counters work for airlines or ground-handling firms, not the port authority. In an agency, contact center agents and field technicians are often contractors. Their contracts should say whether manual procedures are in scope, at what rate surge hours are paid, and who directs them during an incident. A contractor who reasonably asks “is this in my contract?” on day one of a crisis is not being difficult; the agency failed to answer the question earlier.

How long it can last

Manual operations degrade. The first day runs on goodwill. By the second week, people are tired, backlogs grow and error rates rise.

Some workarounds create their own exposure: personal data on paper forms that must be secured, payments made without the usual dual approval, or decisions made without the audit trail a system would have captured. An audit trail is the automatic record a computer system keeps of who did what and when. Without it, an agency may later struggle to show auditors, courts or the public that it acted correctly during the outage.

Plans should state an expected duration for each manual procedure and the triggers that escalate when recovery runs long. Escalation options include mutual aid from other jurisdictions, reduced service hours, temporary suspension of lower-priority services so staff can be concentrated, and pre-arranged surge contracts.

Public-sector ransomware recoveries have often run for weeks, so the plan should assume weeks. Sea-Tac’s own experience fits that pattern: most problems were fixed within days, but the flight displays took until mid-September and the website and app were still down three weeks in. The plan should also include fatigue controls: shift lengths, relief rotations and a named person watching error rates in the manual process.

How the agency returns to normal

Recovery is not complete when systems come back. Every transaction handled by hand must be entered, reconciled and checked. That backlog can take longer than the outage itself, and errors from the manual period surface for months in billing disputes, missing records and audit findings.

Reconciliation should be its own workstream with its own staff, deadlines and quality checks. Manual forms should be designed for later data entry, with the same fields in the same order as the system screen, so that the person typing them in is not hunting around a page. Sequential numbering on paper forms makes gaps visible: if forms 1041 and 1043 are entered but 1042 is missing, someone knows to look for it.

Agencies should also decide in advance how to tell the public about delays that persist after systems are restored, because that is when patience is lowest and complaints peak. People forgive an emergency; they are far less forgiving of a backlog that seems to drag on after the lights are back on.

Finally, the post-incident review should include the people who ran the manual process, since they know which steps failed. Their observations are the raw material for a better plan next time.

A water utility’s manual week, Monday to restoration

The four questions are easier to see as a single story. Suppose a city water utility’s billing and customer service systems are taken offline by ransomware on a Monday morning.

Monday. The security team isolates the network, which also cuts the office phones and email. The customer service manager opens the continuity binder. It lists counter payments as manual, new service connections as degraded (they can be taken on paper but not scheduled) and online bill pay as stopped. A box of numbered payment receipts and a printed list of account numbers are in the supply closet, because someone checked them during last spring’s drill. Staff from the stopped online team are reassigned to the counter under a duty clause agreed with their union two years earlier. Nobody has to argue about it.

Wednesday. Lines are long, but the counter is working. Contracted call center staff have been redirected to a temporary phone line on a separate carrier, as their contract allows, and they are reading from a printed script. A supervisor notices that receipts are being filled out inconsistently and holds a five-minute huddle to fix it before the problem multiplies.

The second week. The systems are still down. The plan had set a five-day expected duration for counter operations, and that trigger has now been passed. The utility reduces counter hours to give staff relief, pauses non-urgent new connections and calls on a neighboring utility under a mutual aid agreement for two extra clerks. A named analyst tracks how many receipts need corrections each day; when the error rate rises, shifts are shortened.

After restoration. The billing system comes back, but there are thousands of paper receipts to enter. A small reconciliation team, set up in advance, works through them in number order. Because the paper form mirrors the billing screen, entry is quick. Three missing receipt numbers are found and traced. The utility posts a clear notice explaining that some bills will be late for a few weeks and why. Meanwhile, a separate team has been working since Monday with counsel on whether customer data was taken.

The work is unglamorous, and all of it was decided before the Monday the systems went dark.

Decisions that belong above operations

To a senior official or board member, manual operations can seem like a detail best left to operations managers. Several features of the problem argue otherwise.

It is a people decision. Who can be reassigned, under what terms, and at what cost are questions about labor agreements, contracts and budgets. Those belong to senior management, and they are far cheaper to settle calmly in advance than in the middle of a crisis.

It is where the public meets the incident. Travelers at Sea-Tac did not see the network; they saw handwritten boarding passes and long lines. The public judges an agency by how well it serves people during the outage, not by its technical recovery timeline.

It carries hidden risk. Paper forms full of personal data, payments without dual approval and decisions without an audit trail are all openings for error, fraud and later criticism.

It decays. A manual procedure that nobody has practiced for years is not really a capability. Skills fade, supplies run out, reference copies go stale and the staff who knew the old way retire.

It runs alongside a second crisis. If data was stolen, the agency will soon be managing notifications, regulators and possibly public pressure from the attackers, while still running manual operations. Both efforts need leaders and staff at the same time.

Where manual plans fall short

A well-prepared agency has a current, service-by-service list marked manual, degraded or stopped, built with frontline staff. It keeps the forms, offline data and supplies that each manual procedure needs, and checks them on a schedule. It has incident-duty terms agreed with employee representatives and written into contractor agreements, a trained roster, and drills of the real work. It sets expected durations, escalation triggers and fatigue controls for each manual procedure, plans reconciliation as a separate workstream, and starts breach response on the first day, in parallel with continuity.

The gaps that undo plans are familiar:

• A plan that stops at “revert to manual.” Without the four questions, the phrase is a hope.
• Forgotten dependencies. The paper process that still needs the phone system, a payment processor or a partner’s database.
• Assuming staff will simply step up. Goodwill is real but runs out, and unclear duties invite disputes.
• Planning for days. Recoveries often take weeks, and the plan should assume so.
• Treating restoration as the finish line. The reconciliation backlog can outlast the outage.
• Ignoring the people who did the work. A post-incident review run only by IT misses the lessons from the front line.

Testing the plan before the outage

• For each service we provide, do we know whether it would run manually, run in a degraded way or stop entirely, and what forms, offline data and supplies each manual version needs?
• Which of our manual procedures still depend on phones, a payment processor, a shared service or another agency’s systems?
• Have we agreed incident-duty terms with employee representatives, and do our contractor agreements cover manual work, surge pay and who directs contractors?
• How long do we expect each manual procedure to hold up, and what triggers escalation to mutual aid, reduced hours or surge contracts?
• Does our plan start breach response on day one, alongside continuity, rather than after systems are restored?

Sea-Tac’s staff showed that a public service can keep running without its systems. That outcome depends on a staffing plan written, agreed and rehearsed before it is needed.

With hindsight

Most airport operations recovered within days, but the fuller story took longer, and it followed a pattern public leaders should expect.

The Port warned in September that, because it would not pay, Rhysida might publish data it claimed to have stolen. This is a common pressure tactic: having already copied data out of a network, ransomware groups threaten to release it if an organization refuses to pay to restore its systems.

Months later, the second crisis arrived. In letters dated April 3, 2025, the Port began notifying people that the attackers had downloaded personal information on August 24, mostly about current and former Port and other airport employees and contractors. That followed a familiar public-sector pattern: the operational outage ends quickly, and the data breach becomes the long tail. The data at stake belonged mostly to the workforce around the long lines, not to the travelers in them.

The Port’s refusal to pay held as a public position. A refusal is credible only if the organization can keep operating and recover without the criminals’ help, and manual operations are part of what makes that stance possible.

Coming weeks after the CrowdStrike outage, the incident reinforced that manual fallback is a capability that decays when it is not exercised. Paper procedures, trained staff and stocked supplies do not stay ready on their own; they need to be maintained like any other system.

It also showed that continuity plans and breach-response plans must run in parallel from the first day, since the second often outlasts the first by months. Leaders who treat the end of the outage as the end of the incident are likely to be caught off guard when notification letters, regulatory questions and worried employees arrive the following spring.

For any public agency, or any organization that serves the public, resilience comes down to the workforce. Technology determines how often you will need the manual plan. People, and the agreements and practice behind them, determine whether it works.