Critical Infrastructure Protection Policy Research Articles

A framework for studying mortality arising from critical infrastructure loss

A key rationale for critical infrastructure protection policy around the world is that the critical infrastructure must be protected because its loss can lead to fatalities, and it is claimed, a large loss of life in some cases. However, little academic attention has been given to understanding the link between critical infrastructure loss and mortality, meaning that the validity of this rationale is uncertain. The limited study of the mortality impacts of critical infrastructure losses stands in contrast to the significant volume of research on the economic impacts of a critical infrastructure loss.This paper conducts an analysis of this neglected area. It identifies critical infrastructure protection policy rationales related to protecting human health in the United States, Canada and United Kingdom. It proposes a conceptual mortality chain model that links the loss of a critical infrastructure to a death. The model has four stages: (i) initiating circumstance; (ii) actual/anticipated critical infrastructure loss event; (iii) hazards; and (iv) cause of death.The paper also proposes conceptual and operational definitions of critical infrastructure death, which are essential to undertaking comparative critical infrastructure mortality analyses. The conceptual definition of a critical infrastructure death is one in which an actual or anticipated critical infrastructure loss event results in a premature death. A critical infrastructure loss event is an event resulting in: (i) a critical infrastructure being destroyed, damaged or affected so that it generates physical forces; or (ii) a loss of critical infrastructure service continuity. Examining anticipated critical infrastructure loss events, as well as actual ones, are important because deaths sometimes occur as people prepare for an anticipated critical infrastructure loss.The operational definition, which is used to identify instances of critical infrastructure deaths fitting the conceptual definition, has four criteria. The first is that a complete mortality chain needs to exist linking a critical infrastructure loss event to an underlying cause of death, where each stage of the mortality chain is related to the previous one. The second is that each stage of the mortality chain must precede the following stage in time. The third is that the critical infrastructure loss event needs to be a necessary element and that, without it, the death would not have occurred when it did. The fourth criterion is that the death needs to occur within a specific period – from two days prior to the actual/anticipated critical infrastructure loss event to one year from the end of the acute phase of the critical infrastructure loss event. However, the period from two days before to fourteen days after the critical infrastructure loss event is the period of greatest interest for critical infrastructure deaths, because this is the time period when the majority of deaths occur.The definitions given above along with the conceptual mortality chain model form the critical infrastructure mortality framework that can be used to study the mortality arising from a loss of a critical infrastructure. The application and utility of the framework are demonstrated by applying it to the 40 victims of the 2012 Hurricane Sandy in New Jersey. The framework provides the foundation upon which comparative mortality studies can be undertaken to determine how, when and why people die from critical infrastructure loss events. This information is essential to being able to undertake evidence-based risk analysis and improve decision making focused on preventing deaths from actual and anticipated critical infrastructure loss events.

Critical Infrastructure Protection

Cyber Warfare holds a grave hazard of striking national infrastructure while circumventing traditional defense systems. This article examines the evolution of Critical Infrastructure Protection (CIP) policy in Israel and analyses its performance. Israel has developed a unique legal and regulatory model for critical infrastructure protection, which was implemented in late 2002. Recently, a comprehensive review of cyber security posture has been conducted, and significant policy changes are in progress. The Israeli approach to CIP and beyond, fostering cooperation between public, security, academic and private sectors, appears to be successful. This study of the evolution of Israeli Critical Infrastructure Protection policy may assist policy-making in other countries.

European Reference Network for Critical Infrastructure Protection

The European Commission has taken the initiative to organize a network consisting of research and technology organizations within the European Union (EU) with capabilities in critical infrastructure protection. Preparatory studies and roadmapping were carried out in 2009–2010 by the European Commission’s Joint Research Centre on behalf of the Directorate-General for Home Affairs. The characteristics were planned on the basis of the priorities of the EU member state governments and critical infrastructure stakeholders, and in coherence with EU critical infrastructure protection policy in general. The network of laboratories is called the European Reference Network for Critical Infrastructure Protection (ERNCIP). It is intended to be a long-term, sustainable grouping with a light management structure based on existing European laboratories and facilities. Its main objectives are to agree on common test methodologies and standards, recommend security certification schemes, develop methods for laboratory accreditation, promote the exchange of good and best practices for critical infrastructure protection, and help the development of a single market in the EU for critical infrastructure protection related products and services. A searchable inventory of laboratories and facilities has been compiled and has been publicly released, with an invitation to organizations to upload their descriptions. Thematic groups have been established to focus on priority areas; eight thematic groups are currently operational and two others are in the process of being established.

Cross-Sectoral Scanning of Critical Infrastructures: from Functional Differences to Policy-Relevant Similarities

The process of shaping an integral critical infrastructure protection policy has turned out to be very demanding due to the growing network complexity of critical infrastructures and deep institutional and policy fragmentation. We argue in this paper that knowing the cross-sectoral similarities among functionally different sectors of critical infrastructures can improve the integral approach. The results of our comparative expert-based cross-sectoral scanning of critical infrastructures in the case of an EU member state confirm the cross-sectoral convergence of several variables. Successful integral and cross-sectoral policy will need to focus on joint threats and risks, objects with similar functions across sectors, as well as multicritical areas, objects and links, including immaterial links. Asymmetric cross-sectoral attention should also focus on those groups of infrastructures with an instant crisis impact on society, groups of the most influential and most sensitive infrastructures according to their network position, and on managing jointly expected cross-border cross-sectoral effects.

Cyber Security of Safety-Critical Infrastructures: A Case Study for Nuclear Facilities

Computers have become crucial to the operations of government and business. Critical infrastructure protection policy has evolved since the mid-1990’s. Since 11 September 2001, the critical link between cyberspace and physical space has been increasingly recognized. Presently, critical infrastructure sectors face various cyber threats. In particular, the electrical power infrastructure is the most critical infrastructure upon which other infrastructures depend. Cyber attacks on energy production and distribution systems could endanger public health and safety, damage the environment, and have serious financial implications, such as loss of production, generation, or distribution of public utilities; compromise proprietary information; or bring liability issues. Government and private sector computer security is affected by various laws, but not all laws reflect newly emerging challenges. At the same, time poor systems management can be costly and disruptive. This paper presents an approach allowing to implement, manage and maintain cyber security program for Instrumentation and Control (I&C) systems of Nuclear Power plants (NPP). It is based on existing standards’ requirements consideration of issues specific to the security of Field Programmable Gates Arrays (FPGA).

Analytical Support to Critical Infrastructure Protection Policy and Investment Decision-Making

Critical infrastructures are complex, interlinked socio-technical systems, with impact often crossing state borders. Their protection involves governments and business organisations, interacting in the application of a broad variety of measures to provide safety and security while investing a considerable amount of public and private resources. This paper examines the challenge of making respective policy and investment decisions transparent, and a sample of methods and tools used to facilitate decision making. It also calls for contributions to a knowledge portal on security and safety of critical infrastructures.

Committed to Protection? Partnerships in Critical Infrastructure Protection

Critical infrastructure protection policy in the United States is broad and complex. The partnership of actors lead by the Department of Homeland Security incorporates “traditional” areas of infrastructure such as water treatment plants and road construction, but also new areas such telecommunications, banking, the food supply, and information systems or “cyberinfrastrucure.” Critical infrastructure protection policy depends upon these actors working together in large, yet loose partnership to identify and mitigate risks to critical infrastructures. In many cases, however, the only thing that these actors have in common is that DHS has designated them to be “critical infrastructure.” How can DHS exhort participation on the parts of different actors? Is this exhortation working?This article examines the efforts of DHS to build a partnership for CIP by specifically looking at mechanisms by which DHS can build commitment to CIP amongst partners (in this case, actors in sectors). A broader contribution of this article, however, is to assess the relative infrastructure focus or coherence of each DHS-designated sector of CIP that is involved in the national plan to protect critical infrastructure. The article relies upon data from federal budgets, sector participant attention to CIP, congressional hearings, and public laws to examine efforts to build new or leverage existing commitment in partners for CIP. I conclude that many of DHS efforts are working, but that success in building commitment is largely confined to sectors with existing ties to earlier conceptions of CIP.

Public–Private Partnerships are no silver bullet: An expanded governance model for Critical Infrastructure Protection

For more than a decade, efforts have been underway to establish Public–Private Partnerships (PPP) for Critical Infrastructure Protection (CIP). Due to issues arising in connection with their implementation, there has been increasing criticism in recent years questioning the usefulness of such PPP. However, cooperation between the state and the private corporate sector in CIP is not only useful, but inevitable. This paper will therefore sketch a new and above all broader approach to public–private cooperation to help solve some of the problems that have become apparent. Based on the network approach developed by governance theory, it is argued that CIP policy should increasingly rest on self-regulating and self-organizing networks. Thus, the government’s role would no longer consist in directing and monitoring, but of coordinating the networks and identifying instruments that can help motivate networks to meet the task of CIP.