Towards a Baltic Sea Region Strategy in Critical ... - Helsinki.fi

CRITICAL INFRASTRUCTURE PROTECTION IN THE BALTIC SEA REGION
This brief comparative review illustrates that the countries and organizations differ
in their interpretations and definitions of what are infrastructures and how to
measure their criticality. While there seem to be no antagonistic contradictions, the
issue is nevertheless not only about adding this or that sector or sub-sector to the
list of CI as there are more fundamental paradigmatic differences. The Nordic
countries, particularly, seem to have adopted broader concepts than the EPCIP
offers. This does not have to be a problem, however, if there is a way to combine
these different approaches without limiting the broadness of the national concepts
and widening the EPCIP concept. The Norwegian model (Figure 7) may offer a
hint of how these broader functionality-based approaches could coexist smoothly,
with the more limited CI approach basically matching the EU’s CI definition.
1.4 PROTECTION – AGAINST WHAT?
If the above-mentioned assets, infrastructures, sectors or functions should be
particularly protected, then the next question is: against what? It seems that the
threat picture is more of a variable than fixed, shifting considerably depending on
the country in question and its recent experiencies.
Cyber threats or physical threats?
While the answer to the subtitle’s question seems obvious – Both! – in practice
finding the right balance is sometimes hard because the issue is largely affected by
historical events. Each new catastrophe creates a learning process that is reflected
in the CIP debates and strategies. Thus Moteff (2003) and Moteff et al. (2003)
have argued that before 9/11 CIP in the United States mainly focused on cyber
security. According to Moteff (2003), it was the 9/11 attacks and subsequent
anthrax attacks that demonstrated the need to re-examine physical protection of
CI. Indeed, while this description is open to interpretation, 20 if one takes a look at
the key policy documents on CIP before 9/11, namely the 1997 report of the
“President’s Commission on Critical Infrastructure Protection” (PCCIP 1997) and
the 1988 “Presidential Decision Directive” on CIP (PDD 1998), this argument can
with some qualification be defended. In analyses of the implementation of the
PDD implementation on the eve of 9/11 the focus was still clearly on cyber
threats 21 .
Though both the above mentioned official documents carry the notion of
physical threats, the spirit of them is that one should prepare in addition or perhaps
in particular for previously neglected cyber threats, because of the growing
technological, computerized interdependencies between the different functions and
infrastructures. Thus, the PCCIP puts it as follows:
20 This argument might be somewhat too strong, if take into consideration that e.g. Hagelstam
(2005), Fritzon et al. (2007) and most others, who have traced the roots of the CIP in the United
States argue (somewhat in contradiction to Moteff’s claim) that the US CIP development was a
direct consequence of the Oklahoma 1995 bombing.
21 See e.g. Moteff (2001) as an example of this kind of analysis.
26 NORDREGIO REPORT 2007:5