Critical Infrastructure Risks and Protection

This article discusses the risks associated with critical infrastructure and how they can be protected. It also explores the roles and responsibilities of government, industry, academia, and non-governmental organizations in managing these risks. A case study of Australia’s power plant is used to illustrate the consequences of poor decision-making. The article also discusses the ownership of critical infrastructure risks at national, regional, and local levels, as well as in the cyber world.

Running head: CRITICAL INFRASTRUCTURE RISKS AND PROTECTION 1
Critical Infrastructure Risks and Protection
Name:
Institution

CRITICAL INFRASTRUCTURE RISKS AND PROTECTION 2
How does Risk information change depending on different decision-makers?
The dynamics associated with multiple stakeholders results in conflicting objectives,
which at times affects the success of the project. The failure of the stakeholders to employ
systematic approaches to accommodate inputs of a wide range of decision-makers can result in
overlooking of important project schedules and estimates. The issue of bureaucracy may hamper
the decision-making process (Osei & Chan, 2015). This is mainly because information has to
undergo many channels and in-between the intended and most core function of implementation
may be totally disregarded as individuals try to push what in their own views may seem right.
Conflict arises in situations where the team charged with implementation of key strategies is
made-up of many agencies. Each member tries to push the mandate of their institution and this
may play out as a battle of supremacy at the expense of generating critical infrastructure risk
management mechanisms that are of high quality. Poor decision-making and implementation
techniques renders critical infrastructure as more of a risk rather than being an asset to be
protected as seen in the following case study of Australia’s power plant.
There was a fire tragedy in February 2009, of which five of the eleven major fires were
due to the failure of assets of electricity. Among the fires, one at Kilmore East resulted in the
death of 119 people. The fire is believed to have been caused by a 43-year-old electrical
conductor. Evidence put forward to the commission investigating the fire suggest that the aged
electrical distributing conductors contributed to the fires. The power infrastructure system was
found to be old, as Victoria’s State Electricity Commission first used them in the early 1950s. In
cutting out the costs, the implementers of the project opted for highly tensile, single lightweight
electrical conductors on the poles (Osei & Chan, 2015). The electricity traveled to the consumer
through a single wire and the current came back through the earth and not the second wire. The

CRITICAL INFRASTRUCTURE RISKS AND PROTECTION 3
increase of population around Victoria put further load on the power supply. It was found that
the cause of the fire was due to insulation failure, aging conductors, and aging assets. Among the
decision makers in this project was the Royal Commission and the State officials of the Victorian
State. Their input may have been conflicting in that the State saw the need to provide the
population with power but did not consider the future outcome in terms of population growth. On
the other hand, the Royal Commission was expected to replace the power-line but they failed to
do so claiming that it was out of this world, in terms of the costs they were to incur. Such
disregards by the commission and the State contributed to the tragedy.
The summary of the happenings in this study provides an insight into the magnitude of
consequences that arise because of indifference in decision-making. The difference between the
input and output of the decision makers is seen largely as having contributed to the tragedy. The
change in risk information, specifically the need to upgrade the power system whatever the cost,
was not communicated to the consumers. The Commission put the need for profit ahead of
safety, while the State was blinded by the need to deliver their developmental mandate and failed
to see the possibility of future population growth taking a toll on the power lines.
Discuss who "owns" risk associated with critical infrastructure nationally, regionally, or
locally. Discuss the same issue in the cyber world.
Critical infrastructure involves critical physical facilities, utilities, and assets of defense
infrastructure, critical industry assets and supply chains as well as networks, information and
communication technology. They are termed as critical because their unavailability for an
extended period of time, will affect the Nation’s socio-economic well-being. The extent of
critical infrastructure covers many sectors such as the economy of a state, treasuries and their

CRITICAL INFRASTRUCTURE RISKS AND PROTECTION 4
departments, local government authorities, finance and banking, power, gas, transport, built
environment, national health, manufacturing, mining and processing industries as well as water
utilities and defense organizations (Ouyang, 2014). The ‘owners’ of critical infrastructures are
the stakeholders. They include; government agencies, the private sector, research institutions,
international organizations, and the Defense agencies. For example, in the United States,
Homeland security, a federal government institution, is mandated with the protection of critical
infrastructure assets (Luiijf, Besseling & De Graaf, 2013). The Department of Homeland
Security was established under the Executive order 13228 on October 2001. The mission of the
Homeland department was to develop the implementation and coordination of national strategy
aimed at securing the United States of America against terrorist attack and to protect critical
infrastructure assets. In July 2002, the strategy of the department was released, showing the
government initiative to protect the US, including working with the private sector. The
protection of key assets and America’s critical infrastructure was among the six important
mission areas. On November 2002, the US Congress approved government reorganization that
led to the establishment of the Department of Defense and the National Security Council. Their
main objective was to protect critical infrastructure and cybersecurity.
The second Executive order created a policy for the protection of Administration
infrastructure. This provided organizational structure and Administration’s policy, specifically
the creation of the President’s Critical Infrastructure Protection Board and the National
Infrastructure Advisory Council. This policy states that the United States has a duty to protect the
economy, the citizens, government services and national security against any risk of critical
infrastructure. The State should ensure any disruption on critical infrastructure is minimal,
infrequent and resolved in the quickest way possible. The implementation of the policy should

CRITICAL INFRASTRUCTURE RISKS AND PROTECTION 5
involve a partnership of the government with the other stakeholders such as the private sector
and International organizations.
In the post September, 2001 terrorist attack in the US, there was a re-organization in the
policies of National security. Apart from taking the lead in protecting critical infrastructures, the
Homeland Security Department is responsible for securing the cyberspace of the US (Quigley,
Burns & Stallard, 2015). Through its branch, the U.S secret service, the Department of
Homeland Security controls the Electronic Crime Task forces and is responsible for identifying
international cybercriminals. The Secret Service also trains law enforcement officers on how to
fight cybercrime through its National Computer Forensic Institute.
What are some of the key roles and responsibilities of government, industry, academia,
and other non-governmental organizations with respect to critical infrastructure risk?
The fundamental role of the government in critical infrastructure is to protect the assets
from imminent attacks. This requires the government to formulate mechanism, plans, and
strategies to deal with any attack. Some of these strategies include collaborating with other
stakeholders. Voluntary collaboration between the private sector and government organizations
is prudent and serves as a primary mechanism for developing a strong action towards national
critical infrastructure resilience and security (Alcaraz & Zeadally, 2015). The government should
make informed economic calculations of the risk posed while also taking into considerations
other non-economic values such as privacy concerns. Such perspectives are important especially
in a world where critical infrastructures are inter-dependent with one another. The government
and the industries share these assets; therefore, they need to forge a strong partnership in their
protection. The partnerships bring about the benefit of information sharing between the private

CRITICAL INFRASTRUCTURE RISKS AND PROTECTION 6
sector and the government. This inclusivity offers a wider range of skill sets between the
government and the private sector personnel, enabling the accomplishment of collective goals.
This gives governmental agencies room to come up with decisions aimed at addressing national
critical infrastructures priorities.
The role of Academia in critical infrastructure risk is not adequately emphasized.
Researchers have played a pivotal role in coining school of thoughts for critical infrastructure
risk management. The researchers came up with the term ‘resilience’ to facilitate the ability of
ecosystems to exist by absorbing fluctuations. They develop scientific methods and conceptual
framework to gauge the socio-economic vulnerability as well as the risks that may face the
critical infrastructure, more so in part of natural hazards and calamities, societal transformation,
and environmental change. They focus on evaluating opportunities to mitigate risks and explore
the adoption of alternative options, as the society undergoes wider economic, cultural, political,
and demographic transformation. The academia uses mixed methods of integrating quantitative
and qualitative data techniques for collecting data and analyzing it. It is also among the
responsibilities of the researchers to ensure they follow the universally accepted and transparent
scientific models to determine areas of vulnerability in critical infrastructure. This includes
finding the criteria for establishing priorities between ethical laden values and scientific values.
They also need to establish the critical threshold for identification of an outcome of a possible
hazard, whether it is tolerable or catastrophic.
Non-governmental organizations are private organizations that offer humanitarian
services by pursuing activities to elevate suffering, protect the welfare of the poor, provide basic
social services, protect the environment and participate in community development. NGOs work
independently and alongside aid institutions from developed countries, informal infrastructure

CRITICAL INFRASTRUCTURE RISKS AND PROTECTION 7
operators, local governments, and self-help associations (Brassett & Williams, 2015). The major
responsibility of NGOs in critical infrastructure risk is to promote sustainability by ensuring
resources are not depleted and empowering communities and mobilizing populations to
strengthen local organizations. NGOs help the government especially in developing countries to
sustain their critical infrastructure through protection of biological diversity and natural
resources, developing projects to support and develop the assets of critical infrastructure, and
increasing the local economic diversity and commitment in championing for social justice. They
promote sustainable community development through service delivery, public policy advocacy,
and education.

CRITICAL INFRASTRUCTURE RISKS AND PROTECTION 8
References
Alcaraz, C., & Zeadally, S. (2015). Critical infrastructure protection: Requirements and
challenges for the 21st century. International journal of critical infrastructure
protection, 8(3), 53-66.
Brassett, J., & Vaughan-Williams, N. (2015). Security and the performative politics of resilience:
Critical infrastructure protection and humanitarian emergency preparedness. Security
Dialogue, 46(1), 32-50.
Luiijf, E., Besseling, K., & De Graaf, P. (2013). Nineteen national cyber security
strategies. International Journal of Critical Infrastructures 6, 9(1-2), 3-31.
Osei-Kyei, R., & Chan, A. P. (2015). Review of studies on the Critical Success Factors for
Public–Private Partnership (PPP) projects from 1990 to 2013. International Journal of
Project Management, 33(6), 1335-1346.
Ouyang, M. (2014). Review on modeling and simulation of interdependent critical infrastructure
systems. Reliability engineering & System safety, 121, 43-60.
Quigley, K., Burns, C., & Stallard, K. (2015). ‘Cyber Gurus’: A rhetorical analysis of the
language of cybersecurity specialists and the implications for security policy and critical
infrastructure protection. Government Information Quarterly, 32(2), 108-117.