It's Not Just About Servers
When a major incident hits — a data breach, a prolonged outage, a corrupted financial transaction — the engineering team's instinct is to fix the system. Restore service. Patch the vulnerability. Write the post-mortem. That instinct is correct and necessary.
But the moment the incident crosses certain thresholds (personal data exposed, financial harm caused, regulated industries affected), a second crisis begins running in parallel — one that engineers rarely train for. Lawyers are assessing liability. Regulators are watching notification deadlines. Journalists are calling the PR team. Customers are deciding whether to leave.
Legal & PR Crisis Management is the discipline of handling these non-technical consequences without making them worse. For engineering leaders, this means understanding a counterintuitive truth: what you write in Slack, what you say in a post-mortem, and how you phrase a public statement can be subpoenaed, quoted in court, and used to determine whether your company pays millions in fines or walks away with its reputation intact.
The engineering team's job during a crisis is to fix the system and document facts. The legal team's job is to manage liability. The PR team's job is to manage public trust. These three goals are not always aligned — and the tension between them is where most companies make their worst mistakes.