Towards a Baltic Sea Region Strategy in Critical ... - Helsinki.fi

CRITICAL INFRASTRUCTURE PROTECTION IN THE BALTIC SEA REGION
from disasters. Indeed, from the perspective of the most recent CIP-related debates
it seems that the concept of CIP is becoming somewhat outdated; the concept of
CIP should be extended to Critical Infrastructure Resilience (CIR), of which CIP is
an important part.
Complete protection can never be guaranteed. As Landstedt and Holmström
put it, even the strongest walls inevitably fail and when this happens, swift damage
control measures, recovery and reconstitution must be taken. For example,
protection and resilience could be compared to a rigid stick and a flexible one,
respectively. The former is harder to bend, but under severe pressure will esnap
and cannot be repaired. By contrast, the flexible stick is easy to bend, always
regains its shape and is hard to break. Therefore, focusing solely on CIP alone may
provide a false sense of security, which can turn out to be disastrous, as has been
proven many times in history. (Landstedt and Holmström 2007)
According to the CIIP Resilience Series Monograph (George Mason
University 2007), “a resilient infrastructure is a component, system or facility that
is able to withstand damage or disruption, but if affected, can be readily and costeffectively
restored.” Very often, achieving the desired level of protection is
simply not cost-effective in relation to the actual threats. A small amount of extra
protection might introduce a large amount of additional costs (as will be discussed
in the following case studies in more detail).
As full protection can never be achieved, we should ask whether the money
could be better spent on making the proper preparations in order to ensure a
graceful degrading of the infrastructure when disaster eventually knocks at the
door. As de Bruijne and van Eeven (2007, p. 24) have noticed, a fringe benefit
from a more resilience-based preparation approach is that these “measures are
substantially less expensive than investments in specific infrastructure upgrades to
avoid certain risk scenarios which may or may not occur.” In short, these
resilience measures encompass such activities or elements as protection,
prevention, training, education, research, deterrence, risk-based mitigation,
response, recovery and longer-term restoration. (Landstedt and Holmström 2007)
It has been proposed that what is especially important here is to create ‘societal
resilience’ capacity relying on joint efforts, training, continuity planning etc. of the
whole society, including communities and businesses, rather than only enhancing
the authorities’ capacities or control (Boin and McConnell 2007). Schulman and
Roe (2007, p. 43) have argued that the key to increased reliability in relation to
resilience “lies not primarly in the design of large technical systems but rather in
their management.”
Landstedt and Holmström (2007) have pointed out that a good example of
resilience in practice comes from the London Underground and bus bombings in
July 2005. The very next day, the trains and buses were running again and the city
was open for business as usual – thanks to prior resilience plans. By contrast,
hurricane Katrina in New Orleans in 2005 is an example of lack of resilience. Too
much emphasis had been on terrorist attacks whereas all other threats, such as
natural disaster, had been sidelined. So when the hurricane hit the preparedness
was far from sufficient and the results were all the more devastating. An example
that especially highlights the importance of resilience over protection alone is the
fact that the telecommunications infrastructure in the affected area was not only
disrupted (e.g. due to power blackouts) but was completely destroyed.
32 NORDREGIO REPORT 2007:5