Sea-Tac’s handwritten bag tags were a staffing plan in disguise
When ransomware took down Port of Seattle systems, the airport kept moving on paper. “Revert to manual” is a promise about people: which work has a paper version, who does it, how long they can sustain it, and who re-keys it afterward.
Looking Back revisits one week at a time, from January 2020 to today, and asks what it meant for the banks, health systems and public agencies we serve. The series was written in 2026, with the benefit of hindsight, and each article says which week it looks back on.
The week
On August 24, 2024, the Port of Seattle, the public agency that runs Seattle-Tacoma International Airport, detected a cyberattack and isolated parts of its network. The outage hit systems the Port operates, including shared check-in kiosks, baggage systems, flight information displays, Wi-Fi, the Port’s website and some internal systems. Through the following week, airlines and Port staff used handwritten bag tags, manual check-in and whiteboards to keep passengers moving, and travelers were told to allow extra time. Core airport systems came back over the following days, with others restored in stages. In mid-September the Port attributed the attack to the Rhysida ransomware group and said it would not pay. The incident came about five weeks after the faulty CrowdStrike update that disrupted Windows systems worldwide, so operational resilience was already in the headlines.
The images from Sea-Tac were of people writing on bag tags and whiteboards. They showed that a public service does not stop when its systems do. It turns into a manual operation, run by staff who may never have done the work by hand. How well that goes is decided long before the incident, mostly by workforce choices rather than technology.
Almost every agency continuity plan contains the phrase “revert to manual procedures”. That phrase hides four questions that follow the life of an outage: what can run manually, who runs it, how long it can last, and how the agency returns to normal. They are sequential and distinct. A plan that answers only the first is just a list.
What can run manually
Some processes have a workable paper version. Others have a degraded version, and some simply stop. Bags can be tagged by hand. A permit office can take applications on paper but cannot check eligibility against a database it cannot reach. A 911 center can log calls on cards, but only if the cards exist.
The useful artifact is a service-by-service list, built with the people who do the work, that marks each function as manual, degraded or stopped. For each manual function it should name what must exist in advance: printed forms, offline copies of reference data, staff contact lists, cash handling procedures, radios and physical supplies nobody has ordered in years. It should also show hidden dependencies. A paper process that still relies on the phone system, a payment processor or a partner agency’s database can fail for reasons unrelated to the agency’s own network. Shared services, such as a county IT department supporting many offices or a port running common-use systems for many airlines, concentrate this risk, because one outage stops many tenants at once.
Who runs it
Manual work needs more people. A step a system did in a second takes a minute by hand, and every queue lengthens. Staff must be redeployed from functions that have stopped, and they need to know where to report and what to do.
This is where plans usually stop being specific. Job descriptions, collective bargaining agreements and contractor scopes may not cover the work people are suddenly asked to do. Back-office staff may need to face the public. Supervisors need clear authority to reassign people across units. Agencies that have agreed these terms with employee representatives in advance avoid a dispute in the middle of an incident. A practical device is a short pre-agreed “incident duty” clause, plus a roster of staff trained in each manual procedure, refreshed annually and tested in drills where frontline staff actually perform the work.
Contracted staff need the same planning. At an airport, many of the people at the counters work for airlines or ground-handling firms, not the port authority. In an agency, contact center agents and field technicians are often contractors. Their contracts should say whether manual procedures are in scope, at what rate surge hours are paid, and who directs them during an incident.
How long it can last
Manual operations degrade. The first day runs on goodwill. By the second week, people are tired, backlogs grow and error rates rise. Some workarounds create their own exposure: personal data on paper forms that must be secured, payments made without the usual dual approval, or decisions made without the audit trail a system would have captured.
Plans should state an expected duration for each manual procedure and the triggers that escalate when recovery runs long. Escalation options include mutual aid from other jurisdictions, reduced service hours, temporary suspension of lower-priority services so staff can be concentrated, and pre-arranged surge contracts. Public-sector ransomware recoveries have often run for weeks, so the plan should assume weeks. It should also include fatigue controls: shift lengths, relief rotations and a named person watching error rates in the manual process.
How the agency returns to normal
Recovery is not complete when systems come back. Every transaction handled by hand must be entered, reconciled and checked. That backlog can take longer than the outage itself, and errors from the manual period surface for months in billing disputes, missing records and audit findings.
Reconciliation should be its own workstream with its own staff, deadlines and quality checks. Manual forms should be designed for later data entry, with the same fields in the same order as the system screen. Sequential numbering on paper forms makes gaps visible. Agencies should also decide in advance how to tell the public about delays that persist after systems are restored, because that is when patience is lowest and complaints peak. Finally, the post-incident review should include the people who ran the manual process, since they know which steps failed.
Sea-Tac’s staff showed that a public service can keep running without its systems. That outcome depends on a staffing plan written, agreed and rehearsed before it is needed.
With hindsight
The airport’s core systems recovered within days, but the fuller story took longer. Rhysida listed the Port on its leak site and offered the stolen data for sale after the Port declined to pay. In early April 2025 the Port began notifying about 90,000 people that their personal information had been taken, mostly from older systems holding employee, contractor and parking data. That followed a familiar public-sector pattern: the operational outage ends quickly, and the data breach becomes the long tail. The Port’s refusal to pay held as a public position. Coming weeks after the CrowdStrike outage, the incident reinforced that manual fallback is a capability that decays when it is not exercised. It also showed that continuity plans and breach-response plans must run in parallel from the first day, since the second often outlasts the first by months.