Towards a Baltic Sea Region Strategy in Critical ... - Helsinki.fi

CRITICAL INFRASTRUCTURE PROTECTION IN THE BALTIC SEA REGION
failures, attacks or accidents above a defined minimum level of services
and aim at minimising the recovery time and damage. CIIP should
therefore be viewed as a cross-sector phenomenon rather than being
limited to specific sectors. CIIP should be closely coordinated with
Critical Infrastructure Protection from a holistic perspective.”
(Commission 2005b)
While ICT/CII can be vulnerable in a multitude of ways, as will be discussed in
detail in Chapter III, in most connections when CII is discussed, it is connected to
cyber attacks (see Wilson 2006), supposing that there are assailants attacking from
a distance through virtual channels. The object of these cyber attacks is not
necessarily CII but any CI. In several EU documents dealing with terrorism this
perspective is raised. The issue becomes that of the consequences of this type of
attack in terms of severity, such as loss of life. One Commission document states
that the consequence of an attack on the industrial control systems of critical
infrastructures could vary widely:
“It is commonly assumed that a successful cyber attack would cause
few, if any, casualties, but might result in loss of vital infrastructure
service. For example, a successful cyber-attack on the public telephone
switching might deprive customers of telephone service while
technicians reset and repair the switching network. An attack on a
chemical or liquid natural gas facility’s control systems might lead to
more widespread loss of lives as well as significant physical
damage.”(Commission 2004, p.3)
Terrorism or all-hazards approach?
The United States, NATO and EU approaches on CIP are clearly dominated by and
closely connected to the threat of terrorism. In the CIP debates in the United
States, the view that “We face a determined, intelligent enemy who seeks to cause
us maximum harm” and therefore one should focus on worst-case analysis (Brown
et al. 2006, p. 16), is clearly hegemonic. But, by way of refinement, it is useful to
emphasise the different phases in the development of the CIP concept from this
perspective.
If one looks at the developments of the CIP in the United States, the
emphasis early on was on deliberate threats (PCCIP 1996; cf. Abele-Wigert and
Dunn 2006, pp. 26-27). It is true that the so-called all-hazards approach was
accepted in United States’ emergency management planning as a ‘second priority’
(Guide for All-Hazards Emergency Operations Planning 1996) and the PCCIP in a
way accepts the relevance of this approach by stating that “Each of the
infrastructures is vulnerable in varying degrees to natural disasters, component
failures, human negligence, and willful human misconduct” (PCCIP 1997, p. 27).
However, the report states that “While poor design, accidents and natural disasters
may threaten our infrastructures, we focused primarily on hostile attempts to
damage, misuse, or otherwise subvert them.” (PCCIP 1997, p. 31)
Naturally, after 9/11 the emphasis on deliberate attacks was hugely
reinforced. The event gave reason to develop the “National Strategy for Homeland
Security” (NSHS 2002), which defined three main strategic goals: to prevent
terrorist attacks within the United States, reduce America’s vulnerability to
28 NORDREGIO REPORT 2007:5