CHAPTER 1: CRITICAL INFRASTRUCTURE SERVICES

‘The next Pearl Harbor we confront could very well be a cyber attack that cripples our power systems, our grid, our security systems, our financial systems, our governmental systems. ’⁴ – Leon Panetta

People have a variety of needs in their daily lives: water, food, clean air, a home and electricity. We also consume many other benefits such as transport services, communication services, television and radio programmes, medical services and banking services. Without some of them, we probably wouldn’t survive – not for long, anyway. Some services are more important to different people at different times – transport connections, communications and medical services may be more or less essential, depending on your circumstances. A common understanding of primary needs is relatively easy to achieve, but when pinpointing vital services we may often end up with different opinions. Defining such services depends on geographic location, climate, season, people’s way of life and other factors. There are services that people have become used to over decades, and their absence causes uncertainty or puts our security at risk. Mobile communication is a good example of this: it is important for people to be in contact with their loved ones, but 30 years ago we managed just fine without mobile phones. We’ve become increasingly used to them and our dependence on them has grown. Many of us feel like we can’t live without social networks.

The lines between vital, socially important and other services consumed by us cannot be clearly and unequivocally defined. From the viewpoint of protecting critical infrastructure, it is important that such services are defined and written down somewhere. Every country should have a specific law that regulates this field. Defining critical services is bound to lead to discussions and possibly arguments about whether or not a specific service is critical, or why one service is critical and another is not. Preparing the list of services is still in its early stages in terms of the entire process of protecting critical infrastructure and CII, and there is still a lot to do. The law can be amended if an important service was left out or a service that was deemed critical shouldn’t actually be regarded as such.

These critical services must be operational:

• power supply

• oil and gas supply

• water supply and sewerage

• harbours

• rail traffic

• air traffic

• data telephony

• data communication

• settlements and cash withdrawals

• law enforcement

• medical assistance.

The list is not final, and the circumstances, characteristics and needs of each country should be taken into account.

Lesson 1: Define critical infrastructure services.