Future of Critical Infrastructure

September 24, 2010

2\

Over the next 20 years, those charged with protecting infrastructure will face unprecedented challenges brought on by accelerating change.

Here a but a few examples:

Today The next 20 years

Vehicles with GPS Smart cars on smart highways

Traditional buildings with little sensing capability

“Smart” buildings that sense maintenance and risk issues

Partially interdependent supply chains

Highly interdependent supply chains

Healthcare, biotech, cyber and other CIKR somewhat independent

Healthcare, biotech, cyber and other CIKR highly interdependent, linked to humans

Static and intermittent monitoring of CIKR (e.g. safety cameras, CCTV)

Continuous, real-time and some autonomous sensing, tracking, and warning systems

The government’s inability to keep up with the private sector causes some friction and issues

The government’s inability to keep up with the private sector causes breakdown of government institutions

The infrastructure environment is changing rapidly

3\

We are dealing with deteriorating infrastructures while addressing the challenges of emerging infrastructures

And the functions of today’s sectors will continue to be vital, However these “sectors” will become more interdependent and their uniqueness will begin to blur

But not everything will change …

Haiti Earthquake, January 2010

www.foxnews.com/static/managed/img/World/Haiti

4\

By exploring these conditions and their convergences, we can gain a better understanding of the potential risks associated with the future CIKR environment

Climate Change

TitleFuture of

Infrastructure& Risk

Environment

Blurred NationalBoundaries

Relianceon Cyber

Migration &Urbanization

“Disruptive”Technologies

Legal & RegulatoryEnvironment

UbiquitousSituationalAwareness

Condition ofI nfrastructure

Hyper-empoweredIndividuals &

Groups

Climate Change

TitleFuture of

Infrastructure& Risk

Environment

Blurred NationalBoundaries

Relianceon Cyber

Migration &Urbanization

“Disruptive”Technologies

Legal & RegulatoryEnvironment

UbiquitousSituationalAwareness

Condition ofI nfrastructure

Hyper-empoweredIndividuals &

Groups

Nine conditions that underlie the future infrastructure and risk environment

5\

Climate change will place greater strain on existing and future infrastructure

Coastal floods, rain, droughts, fires, and other climatic events will test a wide range of critical infrastructure

Temperature Ice Melt Ocean Acidification

http://www.cpc.ncep.noaa.gov/products/expert_assessment/threats.shtml http://current.com/items/89163658_climate_change

6\

By 2025, the global population is expected to be 7.9 billion, mostly in developing countries. 60% of the world population will live in

cities, many of which will be located on coastlines

Global population growth will increase demand for scarce natural resources and strain infrastructures (water, food, energy, etc)

Migration, urbanization, and population growth will change the way citizens rely on local infrastructure

Source: United Nations (adapted

7\

Near term costs are high, but long term costs could be disastrous

• Bridges: it will cost over $930B over next 10 years to eliminate bridge deficiencies

• Dams: $12.5B is needed over the next 5 years to address all critical non-federal dams

• Transit: $15.8 billion is needed annually just to maintain existing transit conditions

• Wastewater: EPA estimates it needs $390B over the next 20 years to meet increasing demand

Necessary maintenance, repair and replacement of aging infrastructure will take time and investment

From: Report Card for America’s Infrastructure, ASCE 2009

8\

The convergence of technology can have the most profound impact on society and may even create new emerging “sectors”

Potential disruptive technologies have both positive and negative implications for infrastructure protection

• Nanotechnology

• Biotechnology

• Alternative fuels and energy

• Robotics

• Imaging

• Sensing

• Communications

• Information Storage and Management

• Materials

• Networks

9\

• Cyber will cross all other infrastructures as we know it

• Information and technology will enable a “smart” or more computer-controlled infrastructure and smarter protection of it

• By 2020, use of mobile computing in health care will extend average life spans by 20 to 25 years

• Implanted wireless devices will continuously monitor health, enabling the medical profession to treat most diseases in their absolute infancy

Unprecedented reliance on cyber and IT brings opportunity and risk to infrastructure protection

Information and technology will enable smarter infrastructure and smarter protection and a emerging “virtual world” to consider

http://www.osti.gov/innovation/research/cyberinfrastructure

10\

The convergence of sensortechnologies and wireless networking will give many people - both good and bad - access to infrastructure information

Various technologies will lead to ubiquitous situational awareness across infrastructure sectors

Source: Open Geospatial Consortium

http://www.opengeospatial.org/ogc/markets-technologies/swe

11\

As the US is more connected to the global economy, the distinction between domestic and foreign infrastructure is increasingly unclear

Integrated systems will exploit greater vulnerabilities. The world’s financial, economic, energy, environment, and other systems are becoming increasingly interconnected

Blurred national borders will force us to rethink our approach to securing critical infrastructure

There will be less control over security as the US depends more on the global supply chain, and is less able to directly influence protection

Source: Bill Kerr Blogsport http://billkerr.blogspot.com/

12\

Terrorists are more likely to launch strategic attacks, aimed at causing significant disruption to our infrastructure systems

Hyper-empowered individuals and adversaries will become more sophisticated

• Adversaries will be able to manipulate information systems, to disrupt response systems, halt public services, disable security systems, gain intelligence, and compromise public trust

• Individuals and groups will continue to attain greater access to worldwide knowledge, technology, and finances formerly achievable only by nation-states

• There will be an increasingly asymmetric threat environment

13\

Changes to our technological, economic and social fabric will force changes in the legal and regulatory environment for infrastructure protection

• Questions of private rights versus open access will likely necessitate changes to existing privacy laws to regulate access to increasingly available information

• Adversaries will remain agile within this information environment, as they are not bounded by domestic legal restrictions

• As technological advancements occur at an increasingly rapid pace, regulation will become more complex as government will have to design regulations that keep up with a changing environment

The future domestic legal and regulatory environment must address increasingly complex systems

14\

Anticipating and preparing for convergences will be the primary challenges for those protecting our critical infrastructure in the 21st century

All nine of these areas will occur in simultaneous and convergent ways

15\

Space Knowledge

These conditions and convergences imply the need for specific actions

Issue Recommendation

1)The nation doesn’t see infrastructure protection as an urgent national priority

1)Make infrastructure protection a more urgent and clear national priority

2) Emerging convergences will reshape how we define and prioritize infrastructures

2) Prioritize and address what constitutes future “critical” infrastructure in the future

3) We need strong cross-sector analysis and advisory capability to better understand impacts of emerging conditions and interdependencies

3) Establish a knowledge integration center to analyze, coordinate, and integrate the nation’s knowledge about protecting our infrastructure

16\

Space

These conditions and convergences imply the need for specific actions

Issue Recommendation

4) Government institutions are unable to meet the needs of our rapidly changing society

4) Define and address where “desyncronization” affects the ability of the government to keep pace with infrastructure protection needs

5) Infrastructure failures have widespread regional impact and involve many sectors

5) Understand impacts of the future interdependencies across all existing and emerging sectors

http://www.css.drdc-rddc.gc.ca/pstp/proj-prop/call-appel/infrastructure/infrastructure_s04-eng.asp

17\

These conditions and convergences imply the need for specific actions

Issue Recommendation

6) No single incentive will encourage all infrastructure stakeholders. Different incentives will apply to different types of infrastructures

6) Establish more innovative incentives for infrastructure protection

7) There is a lack of understanding on how conditions, convergences and challenges will affect the emerging future infrastructure

7) Conduct cross-sector infrastructure-protection games and simulations to understand emerging challenges, interdependencies and future risks

8) Adversaries make decisions and plan attacks much faster than our government

8) Get inside our adversaries’ decision space to proactively stop future attacks on infrastructure

18\

“It is critical that we think beyond the next budget cycle”

Thank you

Aaron Schulman, Toffler Associates

aschulman@toffler.com