Towards a Baltic Sea Region Strategy in Critical ... - Helsinki.fi

CHAPTER I: INTRODUCTION
The Swedish model, which is still in process, is in a similar spirit to the Finnish
one, and is called “Critical Societal Functions” (SEMA 2007) 18 . Thus Sweden too
prefers to use the concept of critical ‘function’ instead of critical ‘infrastructure’ to
emphasise the broadness of the definition. While those functions, summarised in
Table 7, are again largely overlapping with the EU definition of CI, though being
more comprehensive, the whole spirit of the Swedish approach is, like Finland’s,
more about resilience than mere protection. However, the Swedish model differs
from the Finnish one by putting much more emphasis on local than government
level functions, interestingly expressed already in the implicit ‘hierarchy order’ of
the critical or vital functions (cf. the role of the ‘government’ vs. ‘municipal’ in the
Tables 5 and 7 respectively). Although Finland and Sweden resemble each other as
to their respective political and administrative systems, this difference reflects the
Sweden’s rather more decentralised governance.
An important feature in the Swedish definition is that societal functions that
are critical in emergencies can vary from situation to situation. It is not possible to
list all functions that are critical in every situation, which is why it is important to
analyse societal functions that are critical in different situations. This approach is
basically what the more analytical literature calls the “consequence-oriented
definition of criticality”, whereby it is less the infrastructures themselves that are
critical but more the criticality of the consequences of infrastructure failure (Egan
2007, p. 5).
Norway’s CIP system is in a way a combination, or perhaps even a synthesis,
of many approaches. As its Nordic neighbours, also Norway chooses to speak
rather about critical societal functions than mere critical infrastructures. In the
Norwegian approach – called “Protection of Critical Infrastructures and Critical
Societal Functions in Norway” (2006) 19 – both concepts are however included as
elements at different levels, critical societal functions forming a more general level
being dependent on infrastructures. The method, then, to define the criticality of a
particular infrastructure includes three general criteria: Dependability, i.e. a high
degree of dependability implies criticality; Alternatives, i.e. few or no alternatives
imply criticality; and Tight coupling, i.e. a high degree of tight coupling (linkage)
in a network implies criticality. This method is illustrated in Figure 7. This twolayer
system makes it possible to limit the number of CI considerably. The
combination of the Norwegian understanding of CI and critical societal functions
is illustrated in Table 8.
18 See also: Risk- och sårbarhetsanalyser (2005); Threats and Risk Report (2005). However, while
Sweden has rather developed CIP strategies in different fields, in practice this does not always
mean that the risks are minimized. For instance, a recent (November 2007) official study on CIIP
by the Swedish Emergency Management Agency shows that Sweden would be very vulnerable to
attacks on CIIP or to cyber attacks against other CI such as water and electricity supply. Sveriges
beredskap mot nätangrepp (2007).
19
Når sikkerheten er viktigst (2006); and its English summary: Protection of critical
infrastructures and critical societal functions in Norway (2006).
NORDREGIO REPORT 2007:5 23