(5)

 

The next example of the historic juxtaposition of these two archetypal forms of the State is potentially the most disturbing. This is the set of issues that is becoming known as the problem of “critical infrastructure.” A society's critical infrastructure is composed of those elements— telecommunications, energy, banking and finance, transportation, government services—that undergird modern life such that their extended interdiction would have consequences for the sustainability of that way of life. Historically, these elements were confined to national territories. Moreover, these individual elements of the infrastructure were physically and conceptually separate systems that had little interdependence. Generation of electricity by the local power company did not depend, in any immediate way, on the operations of the local phone company or the local bank; the German phone company did not depend on the British phone system, nor did the Japanese banking system depend on the day-to-day operations of the Italian banking system. Beginning in the mid-eighties, however, the interplay among a number of factors created a new largely intangible infrastructure, the international superinfrastructure, that is critically essential to, yet also critically dependent upon, each of the traditionally recognized infrastructures. The factors bringing about the emergence of this superinfrastructure include the many developments in information and communications technology, but also, crucially, a change in attitude among the most highly developed members of the society of states about the role of government and the market. This change in values within many states—which is encapsulated by the claim that we are moving from the era of the nation-state to that of the market-state—has had two effects that are relevant to this problem. First, it has vastly enhanced the vulnerability of the critical infrastructure of states because the reshaping of the various sectors mentioned above (banking, energy, and so on) has taken the path of greater efficiency rather than greater national security. Deregulation and greater competition have meant that there are now more competing operators with access to critical systems, and that operators are no longer monopolists with annual profits guaranteed by the State with which they can be relied upon to cooperate in matters of national interest. The new players have a different attitude toward their responsibilities to the society in which they operate.

Second, each government's role in protecting its state'S infrastructure has become bewilderingly complex, even paralyzing. Two facts are sufficient to make it so: most of the critical infrastructure for the most developed state is in the hands of the private sector, which thus controls the information on which any attempts to ensure security depend; and the origin of attacks on these infrastructures can be made impossible to trace, so that traditional strategies of deterrence and retaliation become irrelevant. It may or it may not be in the interests of Lloyds Bank to disclose to government authorities that a successful intrusion into its accounts had been made by a cyberattack that has cracked its security codes via the Internet, but even if a national government learned of such an attack, which ministry has jurisdiction? Should the intrusion be treated as a domestic crime? As a foreign attack? And if a foreign attack, is it by a state or a criminal conspiracy or some subnational group? Or is the entire affair the work of a disgruntled employee or simply a glitch in the software? Who has the authority to answer these questions, bearing in mind that the costs to the society of an unreported attack will almost always be greater than the costs borne by the private enterprise that suffers the initial loss, but that the private enterprise can be global while the exclusive jurisdiction of the State is, by definition, territorially limited.

The core elements of the international superinfrastructure are the telecommunications networks—which include the landline networks of long-distance telephone carriers, cellular networks, and satellite services—and the collection of information technologies that in the year 2000 was composed of 400 million computers worldwide—about 50 percent of which were in the United States, Germany having 7 percent, China 1 percent—and the Internet, a global network interconnected by means of routers that use a common set of protocols to provide communication among users then numbering about 32 million devices, and expected by 2002 to encompass about 300 million worldwide. Taken together, these three networks (telecommunications, computer, and Internet) supported over 200 million hours of connectivity every business day in 2000. The telecommunications networks are crucial for virtually all aspects of the infrastructures of most states, including their defense operations. In 2001 more than 95 percent of all internal communications by the U.S. Department of Defense went by means of the public switched network. Moreover, the pace of this increasing dependence was quickening.

So long as the nation-state dominated public affairs, it was inconceivable that states would willingly lose control of their national telecommunication industries. If it had been proposed in 1945 that the U.S. Bell System should be dismantled, objections on grounds of national security and law enforcement would almost certainly have trumped efficiency concerns. Today, the desire to bring better service at a lower cost to consumers has made the security and law arguments sound antiquated. In fact the distinctions between local and long distance and between wireline and wireless service providers are beginning to disappear. All aspects of the public switched telephone network have now been opened to competition. In the traditionally monopolistic local markets, local exchange carriers have been required to allow alternative access providers to interconnect to them. The U.S. Telecommunications Act of 1996 cleared the way for cable television operators to offer telephone and other services over their cable systems. As the structure of the industry changes, fewer services will be delivered wholly by a single provider; more often services will involve interconnection and interworking among several providers, which will inevitably mean greater reliance on what I have called the superinfrastructure. As in banking, the industry will consolidate. The Pacific Telesis – SBC and NYNEX – Bell Atlantic mergers in 2000 reflected this trend. Indeed future mergers will be international in scope, such as was presaged by British Telecom's attempted takeover of the MCI network. Thus we will see a more diverse and decentralized system that is, at the same time, far more dependent on a smaller number of electronic gateways.

Banking and finance, after having remained essentially unchanged since the Second World War, are being revolutionized through access to the superinfrastructure, interacting with a political environment that has radically changed regulatory policy. Until the 1980s, the financial services infrastructure of most countries was primarily the product of states that prohibited these institutions from entering specific lines of business, limited the ownership of various types of firms, and prevented banks from operating on an international or even national level. In some states, such as Japan and Germany, many of these constraints were still largely in force at the century's end. Once deregulation occurs, however, financial institutions need advanced telecommunications to remain competitive in the new environment. In the twenty-first century, the infrastructure of national banking and financial services will become heavily dependent on computer-controlled systems and the telecommunications systems that link them together to move instruments of value through the economy. Payment systems, perhaps the most crucial sector in banking and financial operations, rely on a small number of networked information systems to track, finalize, and account for transactions. Practically all communications in the industry use leased terrestrial circuits; and it is anticipated that the trading markets, electronic funds transfer, and other financial functions will migrate to shared networks like the Internet that are more cost-effective. The use of electronic cash is quickly increasing, with a significant impact on the volume and value of transactions flowing through electronic funds. Visa and Mastercard are international systems of banking and debit that would be impossible without this electronic linkage. In the five years from 1990 to 1995 the use of cash in all transactions decreased 5 percent, and this trend is accelerating. The number of banks is expected to continue to decline. Many financial institutions are outsourcing activities, allowing them to focus on core business functions and reduce overhead. The result of this, however, is to concentrate back-office financial functions in a handful of third-party providers connected by the superinfrastructure, so that disruption of one major outsource would affect multiple companies.

Similarly, for nearly sixty years the electric power industry reflected a well-defined pattern of mutually exclusive regulated monopolies, each serving customers in its discrete area. Utilities in the United States and Britain now must unbundle generation, transmission, and other services, enabling rivals to lease lines to send power to their customers. Companies must post data on transmission availability and rates on the Internet. Moreover, in the past, steam-driven generators were the norm, whether relying on coal or nuclear fuel. Now aero-derivative gas turbines make power more cheaply, use less fuel, and are cleaner. With the new technology, power companies can achieve comparable output with plants one-tenth the size. This means that new, smaller companies can enter the market, increasing competition and penalizing older utilities with high sunk costs in outmoded plant and equipment. Today, telecommunications networks hook up to the giant Interconnects that are the islands of the electrical power infrastructure for the developed world. Electrical power generation, transmission, and distribution are largely controlled by a multitude of automated systems that monitor, report on, and in part control the flow of energy throughout these systems. Yet as more players enter the field, the SCADA—supervisory control and data acquisition—systems that manage the flow of energy are becoming more numerous. These standardized, automated systems are linked to control centers that are linked in turn to management systems responding to the increasingly competitive business environment. Thus we have the paradox of more access to competition, meaning more competitors, and yet more centralization and dependence upon the superinfrastructure.

The pipelines that carry oil and gas, like the energy transmission lines, also are controlled by SCADA systems that rely on standardized, automated mechanisms as a way of meeting the pressures of intensified competition. These systems controlled in 2000 much of the 22,000 miles of oil pipelines and 1.2 million miles of gas pipelines, regulating the flow of oil and gas through an array of pumps, vents, valves, and storage facilities throughout the pipeline system. Here as elsewhere, the efforts toward standardization and establishment of common protocols are driven by the high cost of maintaining multiple kinds of protocols, computer hardware, and software. Many infrastructure entities look to the day when virtually all of their operations will run on networks of large computers using standard communications software throughout.

The difficulty posed by these infrastructure developments is that a cyberattack on that structure can now be launched from anywhere on the globe and can have an impact that is compounded by the interconnectivity among essential elements of the infrastructure. The rapid dependence on information that is sweeping the infrastructure is accompanied by a mutual dependency among, and a dramatic lessening of the number of, critical nodes as well as a general standardization. These developments are largely responsible for the increase in wealth that has been brought about by the new deployment of information; unavoidably they have created a situation of very high risk should that information be tampered with or interdicted. The use of information technology has grown from an option to enhance efficiency to a necessity that many parts of the infrastructure require to function.

The critical superinfrastructure provides the link between the processes of quite different organizations and thus, if compromised, has the ability to create a cascading effect, multiplying destruction exponentially. Thus, for example, a national outage of the U.S. public switched network (PSN) would not only bring almost all local service and all long-distance telephone service in North America to a halt; it would also disrupt Internet communications and cut off essential services such as air traffic control, banking and financial transactions, and even the emergency response to deal with the crisis caused by this outage.

Who would mount such an attack? Unlike conventional warfare, this type of operation would offer little strategic warning and few indications of an imminent assault. Physical attacks would be carried out by small, highly mobile units, while individuals equipped with laptop computers could launch attacks from any point on the global network. This form of warfare would be inexpensive, putting it within reach of most groups and most states. As in the world economy, the greatest asset in this conflict would be information: in this case, the information necessary to turn information technology against itself.

Where would such an attack on the critical superinfrastructure come from? It might be the result of a natural disaster, like an earthquake or flood, or of a simple accident at a critical node owing to design flaws, installation errors, or inadequate operation. Or it might be caused by an intentional act of terrorism, like the attacks on the World Trade Center that targeted both the American air traffic network and its financial services industry. The most insidious and conceivably the most damaging threat to cyber systems, however, is a cyber threat. Such threats are new, the product of the information age that gave rise to the superinfrastructure in the first place.

Cyber threats might arise from malicious insiders, from terrorists or military opponents, or organized crime, from hackers or competing industrial firms, or from the national intelligence or defense agencies of other countries.13 National intelligence agencies may wish to siphon off data or even to insert disinformation. In a 1990s incident, organized crime electronically robbed Citibank of $10 million through its branch office in St. Petersburg, Russia; it would be idle to suppose that criminal conspiracies will not explore the possibilities of falsifying criminal records, accounts, and other data stored electronically. Hackers are often students who penetrate government and private systems for the sheer thrill of beating the system. In an era of deep suspicion of the motives of governments and large corporations, the number of such persons will surely increase as the number of persons with computer expertise and experience increases.14 Insiders pose the most dangerous threat because they have detailed knowledge of the systems they attack and ready access to the target's own resources.

Even while economic competition is driving globalization and the centralization of risks that amounts to placing very heavy bets on a few roulette numbers, this same competition provides a strong disincentive to actions in the private sector to ensure information security. Steps that are sufficient from an economic point of view are not necessarily reasonable from the viewpoint of national security and emergency preparedness, but greater measures are more costly, and therefore competitively penalize the company that undertakes them.

Nor is it yet entirely clear what government should do. There are no unified bodies of law devoted to critical infrastructure. Rather there are elaborate fiefdoms of regulation that have evolved in separate sectors seeking to ensure service, public safety, and competition. The government needs private partners to undertake the task of protecting the information superinfrastructure, yet these are the same corporations that are often reluctant even to report break-ins or breakdowns in their operations and who are very distrustful of joint operations with the government.

At bottom, this is a national security problem, but it is also a problem for international security, because the infrastructure we must protect is increasingly international. This fact is a by-product of a much desired goal of the market-state, the creation of a world economy. If states seek to expand the opportunities for every individual, then this will necessarily lead to a globalization of the infrastructure. If a market-state attempted to interfere with this development in order to protect the national security—that is, the security of the national critical infrastructure—it would inevitably sacrifice the expansion of opportunity that is its purpose and thus the reason for which it claimed that it is important to keep the State secure in the first place.

The potency of particular threats to the State changes with each era. A modern army could be quickly suffocated if its logistical umbilical cord were severed by infrastructure attacks, while the mercenaries of the Thirty Years' War, who lived mainly by foraging, could have continued functioning. The reliance of modern armies on telecommunications and electronic computation* has created new and more valuable targets for cyberattack and weapons of mass destruction.

Yet the problem of attacks on critical infrastructure is in large part a private sector problem. If we bring to bear on this problem the strategic habits of the Long War—of the nation-state, that is—we may actually sacrifice the tort liability and corporate responsibility necessary for innovative insurance and improved security practices that would arise from the private sector responding to economic disincentives. If states (in a nation-state mentality) were to try to impose regulatory solutions, these might well be ineffective in any case: there will never be sufficient time or resources to write legal rules ahead of the imaginative cyber designer. Only experienced managers in the sectors themselves, acting daily and learning constantly, can stay ahead of this threat; regulations will always come too late.

These two aspects of the critical infrastructure problem—its private and international dimensions—are unwelcome to most states: internationalizing national security is only a little more distasteful than privatizing it. But there are really very few practical alternatives. Most of us are unlikely to be attackers in this new era, but we will probably all be defenders at one time or another. Cyber threats, in themselves, are poorly analogized to the wars of the past, which depended on violence for their essential character. Rather cyber threats are more like epidemiological threats, in which our ultimate security will lie in the good sense of private persons in many countries, cooperating through a central clearinghouse but assessing their own health and taking the appropriate measures to maintain it. To continue the metaphor, the U.S. Centers for Disease Control (CDC) and Prevention, not the Pentagon, is the model the market-state should pursue in addressing this problem.

Nevertheless, the defense planners of many developed states have an important role to play. Their first step must be to free themselves from the habits they acquired planning for nuclear strategy (just as nuclear strategy fifty years ago required that they free themselves from the habits inculcated by theories of conventional bombing). We must learn to think in terms of vulnerabilities instead of threats; of mitigation instead of fortress defense; of reconstitution instead of retaliation. These changes in our ways of thinking are as crucial to dealing with the problem of critical infrastructure protection as are the technological aspects of the problem.

Vulnerability-based strategies against chemical/biological, nuclear, or cyberattacks will depend upon heterogeneity (the use of multiple means of protection and communication), reassessment (the use of dynamic systems that reallocate resources automatically), redundancy (which depends upon excess information), resilience (which depends upon excess capacity), integrity (which depends upon strong encryption), decentralization (which enables the use of quarantines of both persons and networks), and deception. None of these concepts are new to military planners, but they have to be applied in new, defensive modalities. Our current planning— which depends entirely on detecting a computer intrusion, monitoring it, and tracking down the attacker—is hopelessly ill-suited to our situation. Such retaliatory strategies surrender initiative and permit the aggressor to soak up our resources with little more cost to him than the press of a key. Yet 90 percent of the proposed U.S. 2000 budget in this arena was earmarked for intrusion detection and prevention. The developed market-states should be spending their resources on technologies that make the critical infrastructure more slippery, more difficult to damage, more quickly reconstituted, and, above all, more deceptive.

An historical analogy may also provide some help. At the beginning of the twentieth century, many industrial societies experienced unprecedented migration from rural to urban areas. In America this was augmented by large-scale immigration from Europe. One result was the construction of vast tracts of substandard housing in densely populated city areas. At about the same time the first modern housing codes were promulgated. These set minimal standards for building construction and emergency access. But the real work of protecting cities from fires was done by private insurance companies that required compliance with these codes as a condition for insurance (which was itself a condition for mortgage financing). The increased vulnerability of critical infrastructure has been brought about by the same volcanic economic growth that the United States experienced early in the twentieth century. This vulnerability is also driven partly by consumer demand and partly by the familiar problem of single-actor transaction costs (which tend to jeopardize an entire neighborhood, for example, because the cost to any one actor of a fire does not justify the expense of organizing protection for all). Some similar sort of information security requirement for private insurance can also be useful in addressing the problem of critical infrastructure. Using the market in this way—because insurance is a globalized service—can internationalize a solution far more effectively (and more quickly) than a network of international treaties.

As with environmental threats imposed by a single irresponsible state on all others, it is highly possible that a state linked by the Internet to all other states might threaten, however inadvertently, the critical infrastructure of the entire developed world. And as with global environmental threats, rules for timely intervention are needed. In their absence, we run the risk of introducing some of the classic and familiar causes of war that, when played across the dimension of constitutional change, make the strategic innovation of a cybernated infrastructure attack the kind of tinderbox that could ignite a war in the twenty-first century.