Towards a Baltic Sea Region Strategy in Critical ... - Helsinki.fi

CHAPTER I: INTRODUCTION
must be genuine, mutual and cooperative. In seeking to meet our
national goal to eliminate the vulnerabilities of our critical
infrastructure, therefore the U.S. government should, to the extent
feasible, seek to avoid outcomes that increase government regulation or
expand unfunded government mandates to the private sector.” (PDD
1998, p. 2)
Indeed, the above quotation illustrates the argument of de Bruijne and van Eeven
(2007, p. 25) that when governments have the two options – that of providing the
necessary CIP resources themselves, or by adding state regulation – most CIP
strategies propose neither. Instead, national CIP strategies are usually confined to
the status quo by advocating mere awareness raising, best practice exchange, and
soft ‘commitment power’ efforts with regard to private actors.
In a way, the PPP in CIP is a typical dilemma in that it is worse than a mere
problem, as there are no good solutions available. In these conditions, government
involvement in practical CIP efforts in the private sector remains rather limited, an
argument widespread in more academic debates whereas given less emphasis so in
practical PPP debates. As Robinson et al. (1998) notice, the natural starting point
is that private industry determines investments in protecting the infrastructure
from a business perspective. However, at the same time as the vulnerabilities are
increasing, it has been noticed that while market liberalisation supports policies
which emphasise the importance of low prices for consumers, one ‘side effect’ has
been to reduce the funds available for investment in and maintenance of key assets
(IRGC 2005, p. 1-2). Indeed, security has never been a design driver for market
forces in their dealing with CI (Dunn 2006, p. 29-30). However, Robinson et al.
propose that the key is that in order to have a proper security strategy it is
important that industry has all the information it needs to perform risk assessment.
The primary focus of industry-government cooperation should therefore be to
share information and techniques related to risk management assessment, the
identification of weak spots, plans and technology to prevent attacks and
disruptions, and plans for how to recover from them.
Hurley (2000, p. 4) argues that in this cooperation the private sector’s role
would be to help government authorities in risk analysis and technical issues and
so help them to arrive more quickly at practical, workable solutions to real
challenges. Mussington (2002, p. 31), in turn, argues that this kind of information
sharing should be non-hierarchic. Decentralised, confederated response and
information sharing mechanism for enhancing information assurance seems to
provide a more flexible means of meeting a fast-changing threat to infrastructure
vulnerability than ‘top-down’ methods of managing information assurance.
However, Robinson et al. (1998) have further pointed out that in practice there are
some barriers for this information sharing from the private sector side to that of
the government authorities. From the private company’s point of view,
collaboration may include or require passing over classified and secret materials,
proprietary and competitively sensitive information, liability concerns, fear of
regulation, and legal restrictions. These issues make far-reaching PPP difficult in
practice.
On the other hand, Hurley (2000, p. 4) sees a possibility here. The active
participation of the private sector in development of CIP strategies would help in
promoting general acceptance by the private sector of any regulatory approach that
NORDREGIO REPORT 2007:5 37