Homeland Security Watch

Comment by William R. Cumming

March 30, 2010 @ 5:53 am

Well another great discourse on CIP and the 85% paradigm. Since that year ago litany, a PhD student wrote me asking based on my reference to to the September 1997 PCCIP report as the basis for that number she challenged me for the specific reference. Of course she was right and the report does NOT use that percentage anywhere. I wrote her back agreeing with her conclusion and then suggested that my memory from the Presidential Directive drafting sessions for PD-63 (I attended perhaps 5 of the almost one dozen for FEMA) that I distinctly remember Michael Vatis (last at Dartmouth if memory serves) and then representing DOJ using that percentage. She was last heard trying to track him down. Anyhow she also is researching that issue so hope she reads this post and comment and shares her research with all. Certainly a worth thesis topic.
And to agree with the conclusion of the post, usually SCADA and critical infrastruture are shared by the entire spectrum of the economy whatever the origins or ownership.
What really concerns me almost 13 years later from issuance of the PCCIP report is that so little of regulated industry or standards setting organizations has been devoting sufficient effort to resiliency and interoperability and redundancy and repairability of their systems. The result is that a teenage with a .22 rifle can do significant month long damage to many sectors of the economy much less with explosives or more sophisticated incendiaries.
So hoping this subject reappears from time to time and would be interesting to see the ISACs report on their findings and conclusions on this subject which would seem to be part of their basic goals in developing resiliency.
Another arena that interests me on CIP and cyber security is how come over 2,000 pages of new legislation on health care did not consider any of that concern? Hoping of course I may be wrong and someone might find some. Just as budget impacts are produced by CBO and Environmental Impact Statements and Assessments are produced perhaps we need a statutory mandate across the board or in each new act of Congress for a “resiliency” impact statement.

Comment by Dan O'Connor

March 30, 2010 @ 11:13 am

I think the points Chris Bellavita and Mr. Cumming makes are important but with due respect to them and others; to what end?
Having also dropped the 85% stat in a March 2nd response ;

(Cumming; “…The book appears to have overlooked, and Chris and Dan also, the fundamental flaw in all Homeland Security efforts to date. What is that flaw? Look at the 15 specific scenarios for national planning adopted early on and also look at the dialectic that 85% of all critical infrastructure is privately owned!…”.)

How and what response is expected and/or demanded by the end user? Where do the consumer and citizen fit in? If the number is in fact accurate so what? What is the magical number that action is initiated for a resiliency campaign?

I bring this up because CIP and resiliency now have to grow or be created from and in an increasingly volatile and terse fiscal environment. These institutions will only self correct and/or increase inefficiencies when it affects their bottom lines. This is not a linear problem and therefore the percentage of ownership has a degree of irrelevance to it. Each substrate of critical infrastructure has a co-dependent; power delivery; energy. energy; economy. Economy; revenue stream etc. Where will the surplus capital infusion come from?

Is this a Keynesian problem or a Milton Friedman one in terms of how economics can solve the problem? Is it a DoD problem, where a lot of the technological innovation we currently use was born in the 60’s and 70’s. Is it a DARPA problem? I hear a lot of people like one of their projects pretty well. Even if you used CIP resiliency as a works project, the idea is free, the implementation is costly. Urbanization also makes upgrades and improvement difficult.

Also, critical infrastructure is never revolutionary. It, almost universally is an evolutionary byproduct of growth, technology, and requirement, not the other way around. So it’s a constant retrofit. Need or desire always belays innovation and delivery. Perhaps an overstatement or hyperbole on my part, but that does seem to be the case. It’s astounding that as late as the 1940’s wood was still used for pipes in this country. So is it too big to fail? The better question, from my point of view is how do we make it smaller, repeatable, and redundant; resilient. At the end of the day industry and privately owned companies will only change when it meets their own self interests. Until the end user votes with a change in behavior, it may not matter what percentage of the infrastructure is owned.

Torture numbers, and they’ll confess to anything. ~Gregg Easterbrook

Comment by William R. Cumming

March 30, 2010 @ 11:47 am

Great comment by Dan. My whole point is that we never seem to consider the systems do fail, often with help by human intervention [see the Normal Accident--Perrow]or lack thereof. We actually have designed intentionally most of the critical systems to be highly unresilent and lacking in essential stability. Why? My only explanation is that the system designers have NO incentives to build in resiliency. Perhaps their viewpoint is too stovepiped by their specific expertise and lack of knowledge of impacts of failures. Most levees and dams in the US were built during the 30′s and 40′s and all have a useful life of perhaps 90-120 years. Then what? Were they designed for what happens when their useful lives end due to exceedence or failure or silting? I would argue for broader perspectives–since the internet was a DOD/DARPA initiative but now appears to be leading to allowing catastrophic societal attacks perhaps there is a need for some longer term perspectives? And of course “critical” to who or what segments of society?

Comment by Stiv Morray

July 26, 2011 @ 7:17 am

Also, critical infrastructure is never revolutionary. It, almost universally is an evolutionary byproduct of growth, technology, and requirement, not the other way around.