the vulnerability of interdependent critical infrastructures systems

The Vulnerability of interdependent Critical Infrastructures Systems:

Epistemological and Conceptual State-of-the-Art

Sara Bouchon

Institute for the Protection and Security of the Citizen

2006

EUR 22205 EN

European Commission

Directorate-General Joint Research Centre Institute for the Protection and Security of the Citizen

Contact information European Commission - DG Joint Research Centre, Institute for the Protection and Security of

the Citizen, Traceability and Vulnerability Assessment Unit, TP 361, Via Fermi 1,

I-21020 ISPRA (VA) ITALY

[email protected] Tel: +39 0332 78 5007 Fax: +39 0332 78 5813

http://www. http://ipsc.jrc.cec.eu.int/ http://www.jrc.cec.eu.int

Legal Notice Neither the European Commission nor any person acting on behalf of the Commission is

responsible for the use which might be made of this publication.

EUR 22205 EN Luxembourg: Office for Official Publications of the European Communities

European Communities, 2006

Reproduction is authorised provided the source is acknowledged

Printed in Italy

TABLE OF CONTENTS

1. Executive summary....................................................................................................... 4 2. Introduction................................................................................................................... 7 3. Definition and characterization of a spatial system of interdependent critical infrastructures................................................................................................................... 9

3.1. Defining, characterizing a system and the system approach ............................. 9 3.1.1. Definition of a system................................................................................. 9 3.1.2. The systems approach ............................................................................... 12 3.1.3. Systems characteristics ............................................................................ 14

3.2. Complex systems of interdependent critical infrastructures ........................... 15 3.2.1. A systemic approach to Critical Infrastructures.............................................. 16 3.2.2. Interdependent Critical infrastructures systems.............................................. 16 3.2.3. Conceptual framework for systems of interdependent infrastructures ........... 19

3.3. Complex spatial systems of critical infrastructures.......................................... 21 3.3.1. The application of the systems approach to space......................................... 21 3.3.2. From system analysis to spatial analysis of critical infrastructures............. 23 3.3.3 Critical infrastructures systems as spatial networks ...................................... 25 3.3.4. Definition and characterization of spatial systems of critical infrastructures. 27

3.4. Types of complex spatial systems of critical infrastructures ........................... 29 3.4.1. The scaling factor........................................................................................ 29 3.4.2. The boundaries of a system........................................................................ 30 3.4.3. Processes to be modeled .............................................................................. 32

3.5. Conclusion ............................................................................................................ 32 4. How critical are critical infrastructures? ......................................................... 33

4.1. The existing definitions of critical infrastructures........................................ 33 4.1.1. The definition of infrastructure ................................................................... 33 4.1.2. The adjective critical and the concept of criticality................................. 36 4.1.3. Defining Critical infrastructures and their interdependencies..................... 38

4.2. The notion of criticality ................................................................................... 43 4.2.1. The evolution in time and space of criticality................................................. 43 4.2.2. A subjective standpoint on criticality ............................................................. 45 4.2.3. Two differing but interrelated ways of understanding criticality ................... 48 4.2.4. The scaling factor in time and space............................................................... 49 4.2.5. To which infrastructure or to which part of the infrastructure does the concept of criticality apply? ................................................................................................... 51

4.3. Main policy issues for the identification of critical infrastructures ................ 55 4.3.1. Allocate the resources in the most efficient way ............................................ 55 4.3.2. Identifying roles and responsibilities to define the objectives of the critical infrastructures assessment......................................................................................... 56 4.3.3. Define a methodology to identify Critical Infrastructures and critical interdependencies...................................................................................................... 56

4.4. Conclusion ............................................................................................................ 58 5. The concepts of risk and vulnerability applied to critical infrastructures ............ 60

2

5.1. Existing definitions of the basic concepts in risk analysis ................................ 60 5.1.1. The concept of risk.......................................................................................... 60 5.1.2. Properties of hazards....................................................................................... 64 5.1.3. The concept of vulnerability ........................................................................... 66 5.1.4. The concepts of resilience and adaptation ...................................................... 69 5.1.5. Components of vulnerability........................................................................... 72

5. 2. The application of risk analysis concepts to critical infrastructures ........... 74 5.2.1. From risks to systemic risks............................................................................ 74 5.2.2. From the hazard to the threat concept............................................................. 75 5.2.3. From vulnerability to systemic vulnerability.................................................. 80

5.3. Main issues raised by the application of the concept of vulnerability to Critical Infrastructures .............................................................................................. 82

5.3.1. Vulnerability and criticality ............................................................................ 82 5.3.2. Vulnerability as scale and time-dependent property of systems..................... 85 5.3.4. Which parameters, indicators to express vulnerability? ................................. 88

5.4. Conclusion ............................................................................................................ 91 6. Conclusions.................................................................................................................. 92 7. References.................................................................................................................... 93 List of tables Table 1: Examples of definition for system across various fields (p. 9) Table 2: Characterizing a system of interdependent critical infrastructures (p.20) Table 3: System and spatial approaches to analyze critical infrastructures (p.23) Table 4: Corresponding properties of networks and systems (p.26) Table 5: Elements of definition for Critical Infrastructures (p.40) Table 6: Evolution of criticality criteria and infrastructures considered as critical in US (p.45) Table 7: Actors perceptions of criticality (p.46) Table 8: Vital services provided by Critical Infrastructures (in Netherlands) (p.52) Table 9: Examples of risk definitions in the field of disaster management (p.62) Table 10: Properties and characteristics of hazards (p.65) Table 11: Potential hazards to critical infrastructures (p.76) Table 12: Intentional and unintentional acts as hazards for critical infrastructures (p.76) Table 13: Direct and indirect Vulnerability of Critical Infrastructures systems (p.81) Table 14: Cascading hazards in time after electric power supply failure (p.86)

List of Figures Figure 1: The systemic paradigm (p.11) Figure 2: The structural approach of a system (p.12) Figure 3: The functional approach of a system (p.13) Figure 4: The six systems characteristics (p.15) Figure 5: The electric power infrastructure dependencies (p.17) Figure 6: A system of critical infrastructures systems and their interdependencies (p.18) Figure 7: one example of a systemic approach to space: the Von Thunens model (p.22)

3

Figure 8: a regional system of critical infrastructures (p.24) Figure 9: Spatial system of critical infrastructures (p.27) Figure 10: From reality to the model: the scale factor (p.30) Figure 11: The boundaries of a system: Example of transportation (p.31) Figure 12: The three levels of analysis for infrastructures (p.35) Figure 13: Criticality and crisis (p.37) Figure 14: Criticality criteria to identify critical infrastructures (p.41) Figure 15: Two approaches to criticality (p.49) Figure 16: Main issues related to the definition of critical Infrastructures (p.54) Figure 17: Policy issues of critical infrastructures assessment (p.58) Figure 18: Crichtons risk equation (p.63) Figure 19: Properties of Hazard (p.65) Figure 20: The evolution of the definition for vulnerability (p.66) Figure 21: Hazard-independent and hazard-dependent Vulnerability (p.69) Figure 22: Features of Systems resilience (p.71) Figure 23: Vulnerability model (p.73) Figure 24: Risk Model for Critical Infrastructures (pp.77-78) Figure 25: Cascading Hazards after Electric Power disruption (p.79) Figure 26: Criticality, Dependence, Exposure (p.82) Figure 27: The effects of disastrous events on a society during the development process (p.87) Figure 28: Conceptual diagram of social levels and examples of relevant characteristics identified for the assessment of vulnerability (p.89) List of maps Map 1: Main energy infrastructure in North-West Europe (p.50) Map 2: Main energy infrastructure in north Italy. (p.50) Map 3: Nodes criticality of the energy infrastructure in North Italy (p.83) Map 4: Degree of accessibility of NUTS-regions to the energy infrastructure (p.84)

4

1. Executive summary The main objective of this report is to provide a state-of-the art on the existing conceptual background dealing with the vulnerability of critical infrastructures systems, in order to highlight the main issues for decision-making processes and to provide an overview of all the dimensions of the problem. The first Chapter addresses the terminology and the epistemological background for the analysis of spatial systems of interdependent Critical Infrastructures. It analyses first the definition of a system and of the systems approach. It focuses then on the definition of spatial systems of critical infrastructures, following the background of the spatial analysis of networks. It ends with the study of the factors that affect the construction of systemic models, i.e. the scale of analysis, the choice of the sub-systems and processes to analyze according to the objectives and goals of the analysis. Main conceptual issues are summarized in the following figure representing the territorial dimension of critical infrastructures systems.

A systemic approach to spatial systems of critical infrastructures

Critical infrastructure planning and management

Material infrastructureRegulation

service

Critical Infrastructures

Territory

Territorial constraintsHierarchy

AccessibilityDependencyDiscontinuity

Other stakeholders

ContextLegislation

Technical capacitiesPolitical,

Socio-economical requirements

Territorial backgroundEnvironment

Level of developmentEconomical

SocialPolitical/administrative

cultural


ownersLogic of development

Objectives



service


Territory



Other stakeholders

ContextLegislation






cultural



Objectives

5

The second chapter focuses and the definition of critical infrastructures, highlighting the conceptual debates addressing the notion of criticality. It details the existing approaches to criticality, the complexity of the term infrastructure that reveals various possible levels of analysis and recalls the evolution in time and space of criticality. It underlines as well the various understandings of criticality as a function of actors perception. These elements of a conceptual debate have very specific implication for the decision-making process. The chapter ends therefore with a dedicated subsection on the main policy issues raised by the concept of criticality. The following figure summarises the main issues addressed in chapter 4.

Main issues related to the definition of critical Infrastructures The last chapter provides a review of existing definitions of risks, hazards, vulnerability and resilience within the field of disaster management literature. It allows us defining the following model of vulnerability:

Theological/ systemic

approaches

Criticality criteria National Security and safety

Defense, Public health Business security Social well-being

CIP Context/ Objectives

Time/Scale factors

Actors perception

Decision makers Owners Experts

Stakeholders Insurers

Critical situation Scope

Severity of consequences Effects of time

CRITICAL

INFRASTRUCTURE

To which part? Interdependencies

Infrastructure support Info-structure

Service

6

Vulnerability Model

This review led to the analysis of the specificity of the field of critical infrastructures protection. In this context, the concept of systemic risk appears more appropriate, as the shift towards the concepts of threats, cascading hazards and cascading vulnerability. The focus on the cascading vulnerability shows that various levels of exposed elements can be considered within critical infrastructure systems, whose vulnerability depends on their level of dependency. Since vulnerability is also affected by time and geographical scale issues, these factors have been further analysed, as the question of the definition of accurate parameters and indicators to express it. The conclusion highlights the necessity to adopt a holistic, multi-disciplinary approach to the vulnerability analysis of critical infrastructures systems.

Time

Susceptibility Resilience

RecoveryCoping Capacity

Hazard-independent Vulnerability

Crisis

Hazard-dependent VulnerabilityHazard

Level of exposure

External side Internal side

Likelihood of hazard

Differential exposure

Sensitivity/capacity of the system at risk

Potential losses Effective losses

Effective impacts balanced by capacities

State of emergency

Time

Susceptibility Resilience

RecoveryCoping Capacity

Hazard-independent Vulnerability

Crisis

Hazard-dependent VulnerabilityHazard

Level of exposure

External side Internal side

Likelihood of hazard

Differential exposure

Sensitivity/capacity of the system at risk

Potential losses Effective losses

Effective impacts balanced by capacities

State of emergency

7

2. Introduction Past years have seen an increased numbers of events affecting vital infrastructures our society is relying on: the explosion of the AZF factory (Toulouse, September 2001), terrorist attacks targeting the underground in Madrid (March 2004) and London (July 2007), fire of a petrol deposit (Buncefield, December 2005), etc. Although these events might appear different they have lots in common: - They affected different types of infrastructures that are all considered as critical infrastructures. Critical infrastructures are those of whose services are so vital that their incapacity or destruction would have a debilitating impact on the deface or economic security of any state: electric power, gas and oil production and distribution, telecommunications, banking and finance, water supply systems, transportation, health care, emergency and government services, food supply ((COM (2004) 702 final)). These infrastructure systems are heavily dependent upon one another. Disruption in any of the systems could jeopardize the continued operation of the entire infrastructure system. The adjective critical is related to a key function for the society, highly dependent, and thus highly vulnerable to a potential disruption of these infrastructures. - They were triggered by various sources of hazards but showed the importance of an expanding spectrum of threats including terrorism or other manmade disasters, modifying the understanding of the risks triggering event. This kind of hazard is highly unpredictable and therefore difficult to assess and to prevent. - They had large consequences in societies, well beyond the impact zone. In this view they revealed various aspects of the vulnerability our societies to this kind of systemic risks. The vulnerability assessment of critical infrastructure has thus to face the challenge of providing a multi-scale analysis related to the organisation of a network (several areas related between them through a network), which might be in contradiction with the different areas of competencies of the different administrative and political levels. Following these events, the awareness and the need to better understand the multi-dimensional vulnerability of our territory against events affecting critical infrastructures appeared clearly. This has been expressed in October 2004 in the Communication Critical Infrastructure Protection in the fight against terrorism (COM (2004) 702 final) and in November 2005 in the Green paper On a European Programme for Critical Infrastructure Protection (COM (2005)576 final) provided by the European Commission. . The final objective is to define appropriate measures for a Critical Infrastructure Protection Strategy, in order to ensure an adequate level of security for European citizens. This means adopting the standpoint of decision-makers, who have to deal and manage risks and vulnerability over their territories of competency. Existing literature on critical infrastructures is most often technical, which does not allow decision-makers assessing the multi-dimensional vulnerability of the territory against the disruption of interdependent critical infrastructures systems. In this view, there is a need:

- To define and characterize clearly which are the critical infrastructures for our societies and how they are distributed over the territory, i.e. how they form spatial systems of critical infrastructures.

8

- To understand what vulnerability and risks mean, when referring to this critical infrastructures.

- To identify stakeholders to be involved and to define a coherent strategy for Critical Infrastructure Protection (CIP)

The main issue is related to the specific features of vulnerability and risk related to Critical Infrastructures. Classical risk and vulnerability analysis show some limits and there is therefore a need to define specific definitions, tools, methodologies for critical infrastructures. A systemic approach appears particularly appropriate, since it allows embracing the complexity of interdependent critical infrastructures systems. This requires thus a preliminary work on the epistemological and conceptual background:

- How to define, delimit, and characterize the spatial systems formed by critical infrastructures? What are the epistemological foundations of a systemic approach? To which extent does it allow a better understanding of the inherent complexity of critical infrastructures? (Chapter 3)

- To what does the adjective critical refers? Which are existing criticality criteria? To which extents are they valid and to what kind of infrastructure or piece of infrastructure do they apply? (Chapter 4)

- How to define the concept of vulnerability of critical infrastructures? What are the exposed elements? Exposed to what? How do criticality and vulnerability interact in time and space? (Chapter 5)

The analysis of existing definitions, as well as the epistemological background shows that debates exist on the understanding of the main concepts. These debates are the result of:

- The diversity of fields and approaches using these terms; - The diversity of approaches among various actors dealing with territorial

management; - The inherent difficulties related to the concepts themselves.

The main objective of this report is therefore to provide a state-of-the art on the existing conceptual background dealing with the vulnerability of critical infrastructures systems, in order to highlight the main issues for decision-making processes and to provide an overview of all the dimensions of the problem.

9

3. Definition and characterization of a spatial system of interdependent critical infrastructures

In this chapter, we address the conceptual and etymological aspects of the definition of a spatial system of interdependent infrastructures, focusing on the application of the principles of system analysis to interdependent critical infrastructures and to the spatial system they form. The objective is to provide working definitions to decision-makers, whose first task is to identify, characterize and delimit the territory under analysis. This implies defining and characterizing a system and the system approach (3.1.), defining and characterizing a system of interdependent critical infrastructures (3.2.), defining spatial systems of critical interdependent infrastructures (3.3) and analysing the criteria allowing distinguishing various types of those spatial systems (3.4). 3.1. Defining, characterizing a system and the system approach

3.1.1. Definition of a system

Basically, a system is defined asa group of independent but interrelated elements comprising a unified whole1 and is a set of parts coordinated to accomplish a set of goals (West Churchman, 1968). Among the authors having proposed a general theory of systems (Wiener, 1947; Shannon and Weaver, 1949; Bertalanffy, 1973; Le Moigne, 1977), the definition of a system is based on following properties: Organization, Finality, Adaptation, Openness, Evolution, Totality, Reproduction, Differentiation, Centralization, and Hierarchy. A large amount of definitions have been provided in various fields, having in common the objective to develop a new approach, going beyond the classical analytical causal approach. Table 1 shows some examples of these definitions.

Table 1: Examples of definition for system across various fields

1. (Technical field) Instrumentality that combines interrelated interacting artefacts designed to work as a coherent entity: "he bought a new stereo system"; "the system consists of a motor and a small computer2; 2. (Physical chemistry) A sample of matter in which substances in different phases are in equilibrium: in a static system oil cannot be replaced by water on a surface"3; 3. (Medical) A composite, at any level of complexity, of personnel, procedures, materials, tools, equipment, facilities, and software. The elements of this composite entity are used together in the intended operational or support environment to perform a given task or to achieve a specific production, support, or mission requirement4.

1 http://www.cogsci.princeton.edu/cgi-bin/webwn 2 ibid. 3 ibid. 4 www.nbc-med.org/SiteContent/glossary.asp

10

4. (Biology) A group of physiologically or anatomically related organs or parts; "the body has a system of organs for digestion"5 5. (Structural sciences)A complex of methods or rules governing behaviour: they have to operate under a system they oppose; that language has a complex system for indicating gender 6 6. (Communication Sciences) An organized collection of interrelated elements that performs one or more functions. (The Communication Handbook); "A system divides all of the Universe into a) all of the Universe outside the system, b) all of the universe inside the system, and c) the little bit of remaining Universe which comprises the system that separates the macrocosm from the microcosm". (Buckminster Fuller)7 7. An organized structure for arranging or classifying 8 8. (Ecology/Environmental sciences) The region under consideration, as distinguished from the rest of the universe (the environment). Systems may be separated from environments by boundaries that prevent the transfer of mass (a closed system), of heat (an adiabatic system), or of any energy (an isolated system). Systems that exchange mass with the environment are open systems. Sometimes the word system is also used to refer to all possible compositions defined by a particular set of components (for example, the MgO-SiO2 system)9. 9. (Telecommunications) Any organized assembly of resources and procedures united and regulated by interaction or interdependence to accomplish a set of specific functions. 2. A collection of personnel, equipment, and methods organized to accomplish a set of specific functions.(Glossary of Telecommunication terms)10; 10. (Electricity sector)An integrated combination of generation, transmission and distribution of electricity or natural gas that may be used by 1.) a utility, 2.) a group of utilities through a power pool or 3.) an operator that manages services for more than one system11 11. (Physical geography): A system is a set of interrelated components working together towards some kind of process.(http://www.geog.ouc.bc.ca/physgeog/physgeoglos/s.html) 12. (Regional sciences) A group of independent but interrelated elements comprising a unified whole; a vast system of production and distribution and consumption keep the country going12 13. Organizations that are linked together in the provision of services/products (e.g. transportation system, K-college education system, child welfare). An interdependent linking of organizations that rely on each other for the exchange of resources13 14. A set of actors or entities bound together by a set of rules and relationships into a unified whole. A systems health is dependent on the health of the whole pattern, which can sometimes be reflected (and thus measured) in the status of a key part of the system14.

5 http://www.cogsci.princeton.edu/cgi-bin/webwn 6 http://www.cogsci.princeton.edu/cgi-bin/webwn 7 www.worldtrans.org/whole/wholedefs.html 8 http://www.cogsci.princeton.edu/cgi-bin/webwn 9 expet.gps.caltech.edu/~asimow/glossary.html 10 http://www.its.bldrdoc.gov/fs-1037/dir-001/_0063.htm#JP1 11 http:// www.niagaramohawk.com/glossary/gloss_s.html 12 http://www.cogsci.princeton.edu/cgi-bin/webwn 13 www.childpc.org/about/glossary.asp 14 www.state.nj.us/dep/dsr/sustainable-state/glossary.htm

11

Following these definitions and existing theories of systems, we can assume that a system is (Walliser, 1977):

- One ensemble aiming at fulfilling through various processes a goal, a function, or at providing a service. The system approach is a dynamic and not structural one.

- One ensemble having reciprocal exchanges with an environment; these exchanges ensure a relative autonomy of the system. Autonomy refers here to the fact internal interactions are determined by internal processes and not by external processes.

- One ensemble composed by a structure of components or subsystems interacting with each others, ensuring a relative coherency. If one of these elements is modified, the rest of the system is affected as well.

- One ensemble subject to modifications, pressures, more or less important within the time, but maintaining permanent features.

- One ensemble constituted by a given structure corresponding to its organization. The organization means here that existing interacting processes are depending one upon another, as it can be understood from the etymological roots of system: holds together.

In summary, a system can be defined as an organised ensemble of sub-systems or components and of interacting processes, which is coherent enough to keep a relative degree of autonomy (Figure 1)

ENVIRONMENT OBJECTIVES

Evolution

Processes

Structure

Figure 1: The systemic paradigm

12

3.1.2. The systems approach

Following West Churchman, the systems approach relies on the analysis of what the whole system is, the environment in which it lives, what its objectives are, and how it is supported by the activities of the parts. There are therefore two complementary ways of analyzing a system (West Churchman, 1968):

1- The structural approach answers the question: what is the system made of? 2- The functional approach answers the question: how is it working?

The structural analysis (Figure 2) consists first in identifying the boundary between the system and its environment. The systems environment refers to the fixed constraints, i.e. what lies outside of the system. Environment is what cannot be changed by the activities of the system. It also determines how the system performs: for instance climate conditions are often part of the environment: if the system is operating in a very cold climate so that its equipment must be designed to withstand various kinds of severe temperature changes, then, temperature changes are in the environment because they dictate the given possibilities of the system performances and yet the system can do nothing about the temperatures changes. The environment can be analyzed with the help of a matrix showing the requirements schedule that constrain the system. The second step is to identify the elements (components, sub-systems or black boxes) of the system. Since systems are always embedded in larger systems, the concept of element does not refer here to a single component but is relative to the whole it is part of. These elements are themselves systems (and therefore sub-systems). The level of analysis, and then the boundaries must be defined as a function of the scope of the analysis, so that accurate boundaries of the system and subsystems could be identified. The analysis must then rely on the decision to consider some subsystems as black boxes, which means that these subsystems wont be analysed as such but as interacting component with other subsystems. The last step is to identify existing channels of communication allowing exchanges between elements, i.e. the organization of the system.

Figure 2: The structural approach of a system

SYSTEM

Channels of Communication

Sub-system 2

Component

Component

Component

Boundaries of the system

Sub-system 1

ENVIRONMENT

Requirements Constraints Resources

Inputs Outputs

13

The functional analysis (Figure 3) is based on the analysis of the function rather than on the list of components. The preliminary task is to identify the systems objectives: they refer to the goal and the services a given system has to fulfill or provide. The performances of the system can be measured, with respect to the required level of expected output or service. Most of functional approaches are called input-output approaches or efficiency approaches, having the objective to identify the trouble spots and especially the places where there is waste and then proceed to remove the inefficiency. The input-output approach relies on the principle that system are entities into which are imputed various types of resources and out of which comes some kind of product or service. It aims at exploring what kinds of activities should go inside the system in order to produce the most satisfactory kind of output. This requires assessing the overall performance of the system. In this view, there is a need to develop a measure of performance that is to be maximized, where a weighted environment is partly expressed as output minus the cost of input, where the weights are determined by standards of quality. The performance of each component and their contribution to the performance of the overall system and the allocation of internal resources15 show the internal inputs-outputs processes.

Figure 3: The functional approach of a system16

A fundamental principle of cybernetics is the possibility to apply the systems theory to various approaches: Systems theory or systems science argues that however complex or diverse the world that we experience, we will always find different types of organization in it, and such organization can be described by principles which are independent from the specific domain at which we are looking. Hence, if we would uncover those general laws, we would be able to analyze and solve problems in any domain, pertaining to any type of system17.

15 Resources are the internal means that the system uses to accomplish its objectives. Resources are for instance money, man hours, equipment, technological; advancesetc. To the difference with the environment, resources are the things the system can change and use to its own advantages. 16 http://fwie.fw.vt.edu/rhgiles/Lastingforests/LFConcept1.htm 17 http://www.worldtrans.org/whole/wholedefs.html

14

3.1.3. Systems characteristics

All systems are not similar and following their characteristics, it is possible to distinguish various types of systems. Six main characteristics of systems (Figure 4) are mainly related to the four essential properties of systems: autonomy; coherency; permanence; organization (Dupuy, 1985) (1) Emergence: a system reacts in a different way than the sum of its parts, because of the interactions among these parts (property of coherence); (2) System-environment relation: in the case of quasi-isolated systems, the system is influenced by its environment through processes of inputs, is internally modifying these inputs, has an impact on its environment through processes of outputs. Systems vary as a function of the degree of their openness-closure, depending on the amount of input-output flows. The output of one system can constitute the input for another system or for the system itself (within-puts) (property of autonomy); (3) Stability, stationary and equilibrium: Static is applied to systems subject to constant interactions with their environment and showing constant interactions among their subsystems; Stationary is applied to systems showing constant transformation processes between inputs and outputs flows with the environment and among their subsystems; Stable is applied to a system that recovers its initial shape after having experienced a marginal modification; Equilibrium is applied to systems when they show an equilibrium between inputs and outputs among subsystems. This can refer to immobility or constancy of flows. Homeostasis expresses the capacity of an open system to maintain its structure and its functions thanks to dynamic equilibriums controlled through regulations mechanisms. All these terms refer to the permanency of systems. (4) Causality and finality: in a causal system, the relationship between inputs and outputs expresses a cause-consequence relation. In a system having a finality, the system keeps following its finality, even though it is subject to external pressures. This finality can be optimized (relative to the highest performances) or satisfactory (ensuring a minimum level of performances). (5) Organization: the organization is related to the existence of sub-systems. Each sub-system might be consisting of sub-sub-systems and so on, until black boxes, considered as basic elements. Systems differ as a function of the types of existing interactions and hierarchy among their subsystems; (6) Adaptation, regulation: a system can have the capacity to adapt its behavior to external pressures, maintaining its finality and its permanency. Adaptation can be possible thanks to external regulation, or through internal auto-regulation capacities. The capacity of auto regulations allows assessing the degree of autonomy of a system.

15

After Roger Lewin (1992) Complexity: Life and the Edge of Chaos Steven Johnson (2001) Emergence: The Connected Lives of Ants, Brains, Cities, and Software

Figure 4: The six systems characteristics18

With regard to these elements, it is possible to apply the systems approach to interdependent critical infrastructures. This allows highlighting the conceptual implications of using the system theory to analyze critical infrastructures, as well as defining characteristics of these systems.

3.2. Complex systems of interdependent critical infrastructures The systems approach has been used to identify, characterize and analyse critical infrastructures, here defined as those of whose services are so vital that their incapacity or destruction would have a debilitating impact on the deface or economic security of any state: electric power, gas and oil production and distribution, telecommunications, banking and finance, water supply systems, transportation, health care, emergency and government services, food supply (COM (2004) 702 final). These infrastructures do not exist in isolation of one another and are increasingly interdependent: airports and railways depend on electricity and communications, the power grid depends on communication among power plants and distribution nodes, telecommunications networks depend on power supply for the transmission links and the exchange nodes, etc. A systemic approach is particularly accurate to model and describe systems of interdependent critical infrastructures.

18 http://en.wikipedia.org/wiki/Image:Complex-adaptive-system.jpg

16

3.2.1. A systemic approach to Critical Infrastructures

Critical infrastructures are various in natures (e.g. physical, cybernetic and organizational systems). One way to provide a common basis of analysis is the use of systems approach. This appears being particularly accurate when applied to critical infrastructures since: - Infrastructures are more than just an aggregation of their components. Typically as large sets of components are brought together and interact with one another, synergies emerge. Therefore, they can be seen as systems of interacting agents, based on internal processes. - Critical infrastructures are defined by a number of processes aiming at fulfilling a function, i.e. at providing a service. The inability/ability to provide such services qualifies the overall performance of this specific critical infrastructure. This service must be considered as a critical input to other systems (e.g. other interdependent critical or other systems such as the population, the economical system, etc). The service can be defined as a function of its nature, quantity and quality and the area of delivery; - Each critical infrastructure is placed within an environment such as the geographical, political and economical context, etc. The operating state and condition of each infrastructure influence the environment and the environment in turn exerts pressures on the individual infrastructure (normal system operations, emergency operations, repair and recovery operations).19The boundaries can be limited to the system formed by the infrastructure itself, or to the infrastructure and dependent systems, or to a complex system of interdependent infrastructures. - Each critical infrastructure is made of sub-systems or components interacting among themselves, although of various natures (physical, human, organisational, etc.). The interactions and processes are organized as a structure having as finality the service to be delivered. - Critical infrastructures are subject to modifications (e.g. changes in the economy market, political background, demographical changes, etc.) but show a capacity to a certain extent to adapt themselves to these pressures. The vulnerability and resilience analysis are fundamental to understand the capacity of a critical infrastructure system to resist, reorganize, adapt to external or internal pressure. The application of the systems approach can range from the analysis of a single type infrastructure to interdependent systems, within a system of systems perspective.

3.2.2. Interdependent Critical infrastructures systems Interdependencies among infrastructures dramatically increase the overall complexity of the systems of systems. There is therefore a need to consider multiple interconnected infrastructures and their interdependencies in a holistic manner. We distinguish three main approaches of interdependencies (Rinaldi, Peerenboom, Kelly, 2001):

17

First the focus can be laid on one critical infrastructure system and on the others critical infrastructures systems it is depending on. Figure 5 shows for instance the critical infrastructures the electric power infrastructure is depending on.

Source: Rinaldi, Peerenboom, Kelly, 2001

Figure 5: The electric power infrastructure dependencies In the figure, electric power is the supported infrastructure and natural gas, oil, transportation,

telecommunications, water and banking and finance are supporting infrastructures.

On the contrary to the first approach, the second approach can focus on one critical infrastructure system and on others critical infrastructures systems that are depending on the services provided by the system under focus. Finally, the last approach aims at embracing a whole system of various critical

interdependent infrastructures interacting with each others. Figure 6 gives an example of some existing interdependencies existing among various critical infrastructures systems.

Fuel for generators

Component shipping

Transport to operations

Center

Component shipping

ROAD

AIR

RAIL OIL

WATER

NATURAL GAS

BANKING and FINANCE

TELECOM

ELECTRIC POWER

Repair Crew to Sites

Fuel resupply

Aerial Inspection

Component shipping Fuel Maintenance

Fuel for Generators

Emissions Control

Cooling

Component shipping

Financial services

Materials Procurement

E-Commerce

SCADA/EMS

System Status System control

Operation and Repair Crew

Communication

Fuel resupply

18

Source: Rinaldi, Peerenboom, Kelly, 2001

Figure 6: A system of critical infrastructures systems and their interdependencies

In the view of vulnerability and risk analysis, it is necessary to determine for each infrastructure:

- Which other infrastructure it depends on continuously or nearly continuously for normal operations,

- Which other infrastructures it depends on during times of high stress or disruptions,

- And which it depends on to restore service following the failure of a component or components that disrupt the infrastructure.

For instance, under normal operating conditions the electric power infrastructure requires natural gas and petroleum fuels for its generators, road and rail transportation and pipelines to supply fuels to the generators, air transportation for aerial inspection of transmission lines, water for cooling and emissions control, banking and finance for fuel purchases and other financial services, and telecommunications for e-commerce and for

WATER

TELECOM

ELECTRIC POWER

OILTRANSPORTATION

NATURAL GAS

Fuels, lubricants

Fuel Transport, Shipping

Fuels, lubricants

Fuel for GeneratorsSCADA, Communications

Power for pumpingstations, storage, Control system

Fuels for generators, lubricants

Wat

er fo

r pro

duct

ion,

co

olin

g, e

mis

sion

s re

duct

ion

Wat

er fo

r coo

ling,

emiss

ions r

educ

tion

Powe

r for

pum

pan

d lift

stat

ions,

cont

rol s

yste

m

Water for coolingSCADA, Communications

SCADA, Communications

Power for switches SC

ADA,

Comm

unicat

ions

Heat

Power for compressors, storage, Control systemFuel for Generators

Power for

Signaling, sw

itches

Fuel Transpo

rt, Shipping Shipping

Water

for pro

duction

,

cooling

, emissi

ons red

uction

SC

AD

A,

Com

mun

icat

ions

Shipping

19

monitoring system status and system control. During emergencies or after components failures the electric power infrastructure will have potentially different yet critical dependencies on the same infrastructures. For example, the utility may require petroleum fuels for its emergency vehicles and emergency generators and road transportation to dispatch repair crews and replacement components. The system approach allows addressing the complexity of interdependent critical infrastructures. The definition of the system remains though function of the objectives and scope of the analysis. Once the system is delimited, its characteristics must be analysed.

3.2.3. Conceptual framework for systems of interdependent infrastructures Identifying, understanding, and analysing interdependent critical systems are significant challenges magnified by the complexity of these infrastructures. Further complicating this challenge is a broad range of interrelated factors and system conditions described in terms of six dimensions that affect systems characteristics, and which are summarised in Table 2 (Rinaldi and al.2001). Once they are identified, the choice of the boundaries of the system to analyse and its characterisation are depending on the scope of the analysis. In the view of assessing the vulnerability against the disruption of critical infrastructure systems, the decision-maker needs to identify the spatial system he has to deal with. As it has been presented the modelling of systems does not show the spatial characteristics of the system considered. This dimension is though fundamental since decision-makers do not think on an abstract space, but on a territory, which characteristics must be included under the identification of spatial systems of interdependent Critical infrastructures.

20

Table 2: Characterizing a system of interdependent critical infrastructures

Dimensions Definition Factors/ variables 1. The

infrastructure environment

(Characterize the system-environment

relation)

Framework in which the owners and operators establish goals and objectives, construct value systems for defining and viewing their businesses, model and analyse their operations, and make decisions that affect infrastructure architectures and operations.

Economic and business opportunities, concerns

Public policy Government investment

decision Technical and security

issues Social and political

concerns 2. Types of

interdependencies (characterize

organisation and emergence)

Bi-directional relationship between two infrastructures, through which the state of each infrastructure influences or is correlated to the state of the other.(Gheorghe and Schlapfer, 2004) Interdependencies and the resultant infrastructure topologies can create subtle interactions and feedback mechanisms that often lead to unintended behaviours and consequences during disruptions.

Physical interdependency Cyber interdependency Geographic

interdependency Logical interdependency

(not mutually exclusive and to various degrees)

3. Coupling and response behaviour

(characterize organization, stability,

causality, finality, adaptation and

regulation)

Are conditioning infrastructure responses to perturbations. The coupling characteristics and nature of interacting agents in turn directly influence whether the infrastructures are adaptive or inflexible when perturbed or stressed. (Perrow, 1984)

Degree of coupling Coupling order Linear or complex

interactions Characteristics of the

agents

4. Infrastructure characteristics

(characterize organization, system-environment relation, adaptation, stability)

They refer to time and space dimensions of the system of interdependent infrastructures.

Scale Infrastructure dynamics Operational factors Organizational

considerations

5. Types of failures (characterize

organization, causality and finality, types of

interactions)

They refer to the way disturbances propagate

Cascading failure Escalating failure Common cause failure

6. The state of operation of an infrastructure

(characterize stability, system-environment

relation, organization, adaptability)

It refers to the conditions thought of as a continuum under which an infrastructure is operating and exhibits different behaviours. It can range from optimal design operation to complete failure with a total loss of service to all users, including dependent CI.

Normal operating conditions, (from peak to off-peak conditions)

Times of severe stress or disruptions

Time when repair and restoration activities

21

3.3. Complex spatial systems of critical infrastructures In Human sciences, the systemic modeling has been used combining six fundamental systems of the society (Lapierre, 1992): 1. The biosocial system, i.e. how people interact among each other and reproduce themselves has been defined in demography, sociology, ethnology; 2. The geographical system, i.e. the analysis of the space where these people live and that they transform, creating social territories has been defined in geography and ecology; 3. The economical system, i.e. the analysis of the production and exchange of goods and services required by this population to satisfy their needs has been developed in economy, sociology..; 4. The communication system, i.e. the analysis of communication of information and knowledge between members of the population has been proposed among others by sociolinguist; 5. The Poesis system, i.e. the elaboration and diffusion of symbols, values, beliefs of this population, is the topic studied by sociology, religious anthropology, etc. 6. The socio-political system refers to the social and political rules elaborated to manage the organization of people and are analyzed within political sciences, sociologists, etc. The identification of the systems depends on the standpoint of the expert who wants to study reality. Economists or sociologists do not define a system in the same way. Our focus is here on complex territorial systems, referring to a geographical approach. Though, all systems on the basis of our society interact among each others, and the analysis of one of this system must take account of these interactions.

3.3.1. The application of the systems approach to space

The general theory of the systems has been applied to the space, in order to analyze various spatial organizations (e.g. city, region, state, etc.) The aim was to go beyond sectored approaches focusing on one or more components of the territory and to provide an integrative overview of its complexity. Fundaments of the spatial systems approach rely on the identification of the relations existing among various spatial units. The identification of these relations can be understood as the definition of the various logics that are expressed through coherent and similar spatial patterns. Corresponding spatial patterns can therefore be analyzed as a function of their finality, as a result of these processes that allow distinguishing one type of space from another. These logics, principles, processes are not immediately visible but patterns they produce can be identified in relation with them. The complexity of a spatial system is due to the various interactions between very different elements (physical, human, economic, political components) and to the hierarchy between these interactions (flows of people, goods, information, money, but also political, influence relationships). Challenges associated with the tasks of building mathematical models of complex spatial systems were mainly linked to the identification of the critical values of parameters, at which the nature of the spatial pattern changes, because the nature of equilibrium structure changes. This means that there is a switch from one spatial system to another, which allows defining boundaries of existing spatial systems (E.g. Von Thunens, Webers, Christallers, Burgessmodels).

22

Balancing land use practices and transportation costs using von Thnen's land use model

Profit at the central market depends not only on the market value of the product but also on the transportation costs to get the product to the market.

"Land Use" varies from products of high cost, high market value (such as dairy products and fresh vegetables labeled as Land Use 1 in the diagram above) to low cost, low market value products (such as grain or livestock labeled as Land Use 4 in the diagram above).

As the distance from the central market increases, the profit that would be gained from a product decreases. In the diagram above, if the producer of "land use 1" (tomatoes, for example) needed to transport the product 5 miles, there would be no profit made at the market. This rate of depreciation in market value varies with different land use types. Using the same example, if the farmer had land 4 miles from the market it would be more profitable to produce "land Use 2." An equilibrium is met where the profit of one land use outweighs the profit of another (signified above by the dotted lines). At this point, the land use changes.

Figure 7: One example of a systemic approach to space: the Von Thunens model20

20 www.csiss.org/ classics/content/9.

23

3.3.2. From system analysis to spatial analysis of critical infrastructures In the view of the decision-making process dealing the vulnerability against service disruption of critical infrastructures, it is fundamental to understand how critical infrastructures are embedded in various territories. The systemic representation of systems allows representing how a system is organized, the types of process between its components or subsystems, as well as the type of interdependencies. A spatial representation of these systems shows how elements of the system are localized in space, shows the direction of flows, as well as the distances among sub-systems or elements. Time can also be represented through various maps. Table 3 shows the complementary aspects between a systemic approach and a spatial approach.

Table 3: System and spatial approaches to analyze critical infrastructures Systems analysis Systemic approach Spatial approach Function Nature/quantity-quality of the

service delivered/ boundaries of the system

Areas where the service is delivered (as a function of the scale)/ boundaries between these areas

Composition Sub-systems, components building the system (technical, human, organizational)

Location of the components of the infrastructure, distance among them.

Organization Channels of communication and hierarchy of the relationships among the components and sub-systems (connection, connectivity), competencies of various actors on the infrastructure

Types of spatial organization of the network (graphs theory, density), areas of competencies of various actors

Processes Types de flux, variations dans le temps Types of flows, variations in time and space

Orientation, direction of flows, areas of origin and destination.

system-environment relations Types of interactions with the environment

Administrative, geographical, economical spatial context

Interdependencies Types of interdependencies Location of interdependencies Adopting a spatial perspective allows identifying which areas are depending on a critical service, forming various regions. Usually, a region is defined as a sub-national administrative entity, within a country, between the level of the sovereign state, and the local government, encompassing multiple municipalities, counties, or provinces with a certain degree of autonomy in a varying number of matters, including vulnerability and risk management. A regional system, defined as a complex distributed spatial system, consisting of all existing critical infrastructures, the socio-economic and political systems and the interactions amongst all these elements (Gheorghe and al., 2000), might be different from the boundaries of the administrative region (Figure 8).

24

Figure 8: Regional system of critical infrastructures We identified three main types of regional systems on the basis of the typology proposed by Dupuy (Dupuy, 1985) and on the analysis of systems (West Churchman, 1968):

The homogeneous region is characterized by the homogeneity of its sub-systems or components with respect to a dominant factor. For our research it refers to a regional area characterised by a high concentration of critical infrastructures (e.g. an urban region or an industrial region).

The polarized region refers to a heterogeneous system, in which some components play a polarizing role for the other elements. This refers to the regional area corresponding to the area of delivery of a service provided by a critical infrastructure (e.g. the area of the dependent population to a given hospital, or the area deserved by a major electric transmission centre).

The anisotropic region is a region in which the spatial features are organized following one or more axis or network. This refers to a region regrouping non contiguous areas connected by a critical infrastructure (e.g. a transportation corridor).

e.g. economic

system

e.g. Political system

e.g. Social system e.g. Energy

e.g. Transport

Etc.

Subsystem of CI 1

Subsystem of CI 2

Subsystem of CI 3

A regional system, defined as a

complex distributed spatial system, consisting

of all existing critical

infrastructures, the socio-economic

and political systems and the

interactions amongst all these

elements

25

This raises a major issue for risk and vulnerability management: the definition of a region as a system is closer to the real characteristics and dynamics of a territory and allows identifying the area where critical infrastructures are at risk and pose a risk; however the region seen as an administrative entity, and which is the territory level of reference for the decision-making addressing risks might be different from the regional system at risk.

3.3.3 Critical infrastructures systems as spatial networks

Following Bullock21, recent years have seen a resurgence of interest in the use of graphs and networks as models of many kinds of complex systems. Since critical infrastructures, seen as interacting agents are based the exchange of flows between their components, they can be analyzed through the network analysis perspective. First issue is to shift from a technological approach of the critical infrastructures system to their representation as complex networks. The second issue is related to the localization of this system in the space, in order to analyze the interactions with other systems over a territory. For instance, as far as the transportation is concerned, localization is fundamental to understand how flows originate and what their destination is. The analysis of critical infrastructures systems can therefore not be dissociated from the spatial analysis of networks and their territorial implications. The analysis of networks is one of fundamental principle of spatial analysis, since it focuses on the relations between objects or places. Spatial units, which are not contiguous, may be linked together through an exchange of relations. Basically a network can be defined has an ensemble of lines, communication roads, channels, that deliver a service to the same geographical unit. Natural networks such as rivers or human networks such as electricity network or administrative network put in relation various spatial units. Network can refer to material and physical infrastructure (network infrastructure) or to a relation network referring to the exchanges and types of flows supported by these infrastructures. Networks are most often described using the graph theory. Represented as graphs, they show an ensemble of nodes and links, which refers to the topology of the network (Batty, 2003). Among existing definitions, following properties of networks have been identified: - Connection: refers to the property of networks to link objects or places, through exchanges and circulation of various flows. It allows characterizing the ensemble of existing links among nodes within a network. If we consider, a set of two nodes as every node is linked to the other, connection is the fact that a movement between two nodes is possible, whatever its direction. Knowing connections makes it possible to find if it is possible to reach a node from another node within a graph. - The multiplicity of possible links, the existence of alternative pathways, enhancing the interconnectivity level of a network is called connectivity. A complete graph is described as connected if for all its distinct pairs of nodes there is a linking chain. Direction does not have importance for a graph to be connected, but may be a factor for the level of connectivity. There are various levels of connectivity, depending on the degree at which each pair of nodes is connected. 21 www.comp.leeds.ac.uk/seth/cluster/cluster.ps

26

- Homogeneity and isotropy refer to a spatio-temporal correlation. It expresses the coherency in time and/ or on a given space, between inputs-points and outputs points. - Centrality refers to the hierarchical position of a node within a network. Following these properties, all networks can not be considered as a system. They have to show the previously identified properties that characterize systems, i.e. (Dupuy, 1985): - Autonomy: a network must have a relative autonomy to be analyzed as a system, which means that it must have enough internal relationship internal, reducing its dependence from the environment. - Coherency: existing subs systems of the network must show a given level of coherency, through their interactions and their interdependent relations characterizing a coherent ensemble and therefore the existence of a system. This implies also a relative homogeneity of the network. This refers to the level of connectivity and connection of a network, as well temporal correlations ensuring homogeneity (for instance, each points of a transport system must be reached in a given laps of time) - Permanency: the network must have a certain permanency in order to support the production of a permanent system. This implies permanency of physical elements of the network, of its functions, as well a relative level of reliability insuring the permanency of the function, depending also on the organization of the network (redundancy); - Organization: refers to the way a network is organized and to the types of hierarchy among various elements. The level of centrality of each nodes of a network determines the organization of this network as a system. In summary, to analyze networks as systems or systems as spatial networks they need to show corresponding properties as shown in table 4

System Network

Autonomy Permanency Coherency Organization

Connection

Connectivity

Isotropy

Homogeneity

Centrality

After Dupuy, 1985 Table 4: Corresponding properties of networks and systems

Critical infrastructures systems analyzed as networks allow identifying the related spatial systems that must be considered as the region of reference for risk and vulnerability analysis.

27

3.3.4. Definition and characterization of spatial systems of critical infrastructures

The application of the spatial systems theory to the analyze of the territory covered by critical infrastructures takes place in the reflection on the definition of networked territory and allows identifying various types of spatial systems of interdependent critical infrastructures. Networks can be analyzed as territorial systems, where the spatial territory is not anymore considered as an administrative product but as the product of the paradigm system/network. A territory is a portion of the earth surface, appropriated by a group, in the view of ensuring its reproduction and the satisfaction of its vital needs. This appropriation goes necessarily through the control of the mobility within the territory and through the setting up of permanent links among various units of the territory. Each territory is therefore the result of a combination of subsystems that are summarized in the figure 9.

Figure 9: Spatial system of critical infrastructures



service


Territory



Other stakeholders

ContextLegislation






cultural



Objectives



service


Territory



Other stakeholders

ContextLegislation






cultural



Objectives

28

Critical infrastructures owners: Critical infrastructures are fully or partly created and managed by their owners, as a response to their objectives and logic of development. In thinking about the objectives of a system, it is natural to ask whose objectives are to be served. Customer provides the base in terms of which the decision-making ought to occur in the proper design of a system. The objectives determine the type of service to be delivered, its quality and its quantity. Basically the definition of the objective can refer to two main types of logic, as a function of the degree of government ownership and regulation. - Heavy regulated infrastructures are public infrastructures such as water, energy, public transport systems. Owners focus on service provision rather than on the profit concerns that motivate private sectors owners. Nevertheless they still need to address economic and business concerns (e.g. cost of changes to their system architectures, maintenance, technology upgrades, and changing service demands from growing or contracting communities); -Unregulated, private-sector infrastructure firms focus more on business concerns such as profitability, economics, business concerns, cost of financing, availability of skilled workforce, market competition, imageetc) but still need to address issues about the quality of service. Context and other stakeholders are determinant subsystems having an impact on

Critical infrastructures creation and management. The context refers to the existing legislation, the socio-economic requirements, the technical capacities of societies, as well as the political context. Other stakeholders include decision-makers, customers association, insurers, and all the actors concerned with the critical infrastructures service. They form the environment of the system. Critical Infrastructures planning and management are the result of the

objectives, logic of development of the owners, as well as a response to the environment constraints. Planning and management concern at least three levels: the material infrastructure itself (technical, design, localization), the regulation dimension (functioning of the infrastructure, fee policies, control systems, etc.), and the service dimension (nature, quantity, quality). The Critical Infrastructure territory is a result of the planning and management

activities and corresponds to the space of the material infrastructure associated with the areas where the service is delivered. These spatial patterns are the result of the appropriation of the territory by owners through the environment constraints. As a function of the critical infrastructure considered, territories are very different. Railways networks for instances have a much more limited and constrained territory than road networks. The combination of the Critical Infrastructure territory and of territorial

background, i.e. the economical, social, political, cultural patterns of a region is expressed through territorial constraints. Networks express the fundamental heterogeneity of the geographical space. With respect to the classical acceptance of a territory as a

29

continuous area, networks imply spatial discontinuity. Territories are not anymore the result of proximity, but the result of a link joining spatial units, that have in common to be dependent on the same network. The accessibility to the services or functions of a network is characterized by entry points (e.g. stations for railways, access to roads, etc.), which are not equally spread over the territorial background. Networks create therefore hierarchies among spatial units and are a factor for the differentiation of space. In order to characterize a spatial system of critical infrastructures, the role of each subsystem must be assessed, since they determine various types of systems. The objectives of the analysis, as well as the scale of work are other factors that need to be taken on board. 3.4. Types of complex spatial systems of critical infrastructures The systems approach is based on the modelling of the reality as a system, which implies a process of generalisation, which in turns allows analysing better the reality. Even though, the reality defies precise formulation in terms of a model, it is a way to think about it. The construction of a spatial system model of critical infrastructure must therefore answer the need of the actors trying to understand it and must be accurately defined as a function of the objectives of the analysis.

3.4.1. The scaling factor

Closely related is the notion of geographic scales given that infrastructures span physical space, ranging in scale from cities, regions, and nations to international levels. The particular scale of interest is largely a function of the objective of the analysis. Deliberations on national energy policies may require analysis at the infrastructure, interdependent infrastructure, national, international levels, whereas an analysis of the failure of a single natural gas compressor might require studies at the system level and below. These granularity considerations lead to trade-offs in model fidelity and database/computational requirements. A high level of detail implies more data on the infrastructures their components and interdependencies as well as more intensive computational requirements. Spatial scale has clear implications for the way in which interdependencies are included in analysis. The characteristic of critical infrastructures systems is that what happens to one infrastructure can directly and indirectly affect other infrastructures, impact large geographic regions, and send ripples throughout the national and global economy. There is therefore a need to adopt a dynamic view on the scaling factor, allowing shifting from local scale to a much broader area (Figure 10). The variations of scale in space are associated with the variations in time. A system of critical infrastructures refers to various time scales: while the setting up of the material infrastructures might take years (the construction of road networks for instance), the delivery of the service must be analysed at daily scale for instance, while an emergency management should be dealt in an even shorter delay.

30

(Wu, David, 2002)

Figure 10: From reality to the model: the scale factor

3.4.2. The boundaries of a system The boundaries of a system, the choice of the subsystems, processes that will be modeled, must be defined as a function of the scale of analysis and of the objectives of the analysis. Since reality is complex, the definition of the system must rely on a selection of the most accurate elements. Boundaries can range from the delimitation of an elementary model, focusing on basic components to the delimitation of a complex system, including more subsystems. Figure 11 shows for the transportation system, examples of possible delimited systems.

31

Figure 11: The boundaries of a system: Example of transportation

All vehicles

control systems,

All activities generating flows(goods, passengers, information, energy)

between origin and destination

Networks oftransportationinfrastructures

Drivers

Activity generating flows(goods, passengers, information, energy)


Vehicle Drivertransportationinfrastructures

Vehicle Driver

transportationinfrastructures

Vehicle

Driver

Vehicle and related sub-systems

Complex system

level

Elementary system level

Tech

nica

l sys

tem

ap

proa

chS

patia

l sys

tem

ap

proa

chAll vehicles

control systems,




DriversAll vehicles

control systems,




Drivers







Vehicle Driver


Vehicle Driver


Vehicle

Driver

Vehicle

Driver

Vehicle and related sub-systemsVehicle and related sub-systems

Complex system

level

Elementary system level

Tech

nica

l sys

tem

ap

proa

chS

patia

l sys

tem

ap

proa

ch

32

The choice of the boundaries of the system is also depending on the actors analyzing the system of interdependent critical infrastructures. For instance, following the standpoint of decision makers, the system under analysis might be delimited within the limit of their administrative limits of competency (a city, a province, a region, etc.). On the contrary, in the logic of critical infrastructures owners, the limits of the system will be extended to the spatial inscription of the infrastructure. The difficulty lies in the combination of these approaches, in order to take on board the requirements of various types of actors. This implies thus to define which process will be modeled and represented.

3.4.3. Processes to be modeled The representation of all processes within the boundaries of a system might trigger confusion. There is therefore a need to choose the representation of the spatial system for one criterion, e.g. the repartition of the material infrastructure in space, the accessibility of various connected areas to the service, the polarization of one node of the network over the system of over an area, the quantity of flows, etc. The processes to be modeled vary as a function of the entry point in the system: this can be one particular node of the system, a particular link between two nodes, a particular deserved area or a combination of this. 3.5. Conclusion The identification of spatial systems of interdependent critical infrastructures answers the problems and objectives set up by the context of their analysis. A systemic approach allows embracing the organisation, location and functioning of critical infrastructures systems, based on human, technical, political, geographical, social sub-systems, according to a territory. Though, the territorial dimensions of critical infrastructures systems might be different from the administrative levels of reference for decision-makers and risk management. This highlights the need to carry out the vulnerability assessment in the context of a participative process, involving various actors and encouraging interdisciplinary collaboration. The system approach allows addressing the complexity of interdependent systems of critical infrastructures. Further reflection on the concept of critical infrastructures allows defining hierarchies and priorities for vulnerability analysis within these complex systems.

33

4. How critical are critical infrastructures? In response to the London terror attacks, the UK presidency underlined the need for urgent action to agree measures for the protection of crucial infrastructure in the event of a terrorist attack22. Before the London attacks, the European Council of June 2004 had already asked the Commission and the High Representative to prepare an overall strategy to protect critical infrastructure. In October 2004, the Commission provided the Communication from the Commission to the Council and the European Parliament Critical Infrastructure Protection in the fight against terrorism (COM (2004) 702 final). Following the Communication, the first task is to define Critical infrastructures at Member States level and at European level. Such lists should be established by the end of 2005. The second objective is related to the vulnerability assessment of these Critical Infrastructures, including the vulnerability related to their interconnectedness and interdependence. In November 2005, a drafted Green paper On a European Programme for Critical Infrastructure Protection (EPCIP) was provided, outlining possible options for EPCIP (COM (2005)576 final). These objectives show that a common definition of critical infrastructures is one of the main issues to define an appropriate framework for CIP. How far existing definitions are valid and what do they miss (4.1)? How to define and measure the criticality (4.2.)? Which are mains policy issues related to the identification of Critical infrastructures 4.3.)? 4.1. The existing definitions of critical infrastructures

Most often, the definition of critical infrastructures has been elaborated in the context of critical infrastructure protection (CIP). Reviewing world-wide CIP activities, Ritter and Weber state that the definitions of critical infrastructures in different countries are as diverse as the concepts of infrastructure protection that have been developed in those countries (Ritter, Weber, 2004). In addition, these definitions have been developed on the basis of the terms of infrastructures and critical, that may refer to various meanings under different contexts. What are thus the etymological roots of critical infrastructures? What do existing definitions refer to? What do they have in common and what do they miss?

4.1.1. The definition of infrastructure In the Dictionary, infrastructure is defined as the set of interconnected structural elements that provide the framework for supporting the entire structure. This term can overlap with the notion of internal improvements and public works23or as the basic facilities, services, and installations needed for the functioning of a community or society, such as transportation and communications systems, water and power lines, and

22 BBC News Europes anti-terror capacity; Wednesday 13 July, 2005. http://news.bbc.co.uk/2/hi/europe/default.stm 23 http://en.wikipedia.org/wiki/Critical_infrastructure

34

public institutions including schools, post offices, and prisons.24 Other definitions include banking and financial institutions, oil and gas supplies, health and emergency services, as these infrastructures ensure daily survival for each and every one of us25. Following the field of interest, infrastructure is defined more precisely: in Technology, infrastructure refers to the basic, fundamental architecture of any system (electronic, mechanical, social, political, etc.) determining how it functions and how flexible it is to meet future requirements26. In Economy, infrastructure is the basic physical systems of a business or nation, needed for a country to be efficient and productive27. For a cyber-system, infrastructure is the stock of basic facilities and capital equipment needed for the functioning of a country or area28. In the military field, they are all building and permanent installations necessary for the support, redeployment, and military forces operations (e.g. barracks, headquarters, airfields, communications, facilities, stores, port installations, and maintenance stations)29. In an urban planning context, the term is used most often to denote the facilities that support specific land uses and built environment. Two groups of infrastructures are distinguished: transportation modalities (roads, rail, etc.) and utilities. Infrastructure may also refer to necessary municipal or public services, whether provided by the government or by private companies30. Common elements to these definitions are thus (Figure 12): Infrastructure is the underlying base, architecture or foundation for an organisation

or system. However, what is considered to be infrastructure depends heavily upon the context in which the term is used. Historically, the sense of the word infrastructure has been evolving: it has been first used in the context of technical debates about public works, designing thus urban networks and facilities. The term also has had specific application to the permanent military installations necessary for the defence of a country. The role of infrastructure for the economic development and as one of the main sector of public investment lead to the inclusion of economic networks, referring to technical and more immaterial networks. Nowadays, infrastructure is used in an even more broad sense, referring to almost any kind of substructure or underlying system. Big corporations are said to have their own financial infrastructure of smaller businesses, for example, and political organizations to have their infrastructure of groups, committees, and admirers. 24 The American Heritage Dictionary of the English Language, Fourth Edition, Houghton, Mifflin Company, Boston, MA. 2000 25 http://www.answers.com/topic/infrastructure Transport: Roads, Highways, Railroads, Public transport, Airports, Ship transport such as ferry and barge, Bike paths, Sidewalks; Public utilities: Electricity, Natural gas, Coal delivery, Water supply, Sewers, Telephone service, Radio, and television; Public services: Fire service or fire department, Flood protection, Police protection, Waste management, public education, public health system, social insurance system; National Services: Defense, Monetary system, Postal system 26 http://www.computerlanguage.com/at.html 27 http://www.investopedia.com/ 28 Word Net 1.7.1 Copyright 2001 by Princeton University. 29 US Department of Defense Dictionary of Military and Associated Words, 2003. 30 http://www.answers.com/topic/infrastructure

35

Infrastructure can refer to a physical, material structure (e.g. roads, pipelines, school, etc.) and/or to immaterial networks (e.g. banking system). Both aspects are not exclusive, since an infrastructure may rely on physical elements (e.g. built elements) and immaterial elements (e.g. rules for the good functioning of the network, personal interrelationships, etc.). Some authors distinguish though hard infrastructure, i.e. infrastructure embedded in the landscape and soft infrastructure that denotes institutions that maintain the health and cultural standards of the population, e.g. public education, public health systems. We may therefore distinguish three levels of analysis of an infrastructure: (1)

The basic material elements of the infrastructure, requiring high cost public or private investments are the focus of a technical and engineering approach (2) The info-structure refers to the procedures, rules allowing a good functioning of the infrastructure (e.g. signalisation for a transportation infrastructure) and is analysed through a regulatory approach; (3) The service delivered through the infrastructure, based on the existence of providers and end-users, an supply-demand context, a flow of goods, people, information and whose efficiency may be qualitatively of quantitatively assessed.

Figure 12: The three levels of analysis for infrastructures The first issue regarding the definition of critical infrastructure is thus to understand which infrastructures are concerned and to which level the adjective critical has been applied. The existing literature shows that there is confusion between the material infrastructure itself and the service considered.

Infrastructure as underlying basis of the

system

Infrastructure-support

Info-structure

Service

Material/ Immaterial structures

Hard/soft infrastructures

Nature

Flows: Quantity/Quality

Areas of delivery/Accessibility

Supply/ Demand constraints

Etc.

Functioning procedures

Regulation

Control systems

Fee-policies

Etc.


system


Info-structure

Service


system


Info-structure

Service





Nature

Flows: Quantity/Quality

Areas of delivery/Accessibility

Supply/ Demand constraints

Etc.

Nature

Fl

the vulnerability of interdependent critical infrastructures systems

Documents

systems approach

systems characteristics

system approach

system analysis

spatial networks

systemic approach

en luxembourg

conceptual framework