FIGHTING SHADOWS Protecting National Security and Critical Infrastructure against the Unknown Katri Liekkilä (KTM), SMVIR/SM5 MPKK / Huoltovarmuuskeskus M.M.Sc Thesis

In this presentation Research background and motivation Theoretical frame of reference Research design and data Preliminary findings Status of research Framework model under construction

Research background and motivation National security and critical infrastructure tightly knitted in modern societies Ownership of critical infrastructure Disruptions Responsibility over national security = Responsibility over critical infrastructure (protection)?

Research questions (ATM) Does a combination of risk management and resilience offer the best qualifications for nations to protect critical infrastructure under disruption? – If yes, do risk management and resilience exists simultaneously are therefore complimentary? – If not, which one is more important during disruption? – What are the key differences between risk management and resilience? What confirms the existence of resilience in a nation? – Can resilience be fostered? Is PPP related to critical infrastructure protection part of risk management, resilience or both? – What is the relevance of suitable objectives for private actors when deciding their engagement in critical infrastructure protection?

Theoretical frame of reference Uncertainty Risks Resilience Public- private partnerships (PPP) Their relationship with 1) National security and critical infrastructure protection 2) Each other

Research design and data Abductive research logic -Dialogue between phenomenon and theory -Logic of discovery Research rounds -Theory (theoretical propositions) -Thematic mapping -Interviews  case study- like set up Data - Finland, France, Norway, Sweden and Switzerland - National documentation and interviews

Preliminary findings National security strategy = risk management + scenario planning.  Theory: risk management unsuitable for unknown disruptions Uncertainty: Risk management leads to Resilience  Theory: Different methodologies for risk management and resilience, mean-effect relationship not possible Resilience undefined and debated  Suggestion: should be defined by user when used PPP and private sector engagement in CIP mandatory  No established definitions for purpose or objectives Notion of threats

Status of research Theoretical frame of reference Thematic mapping Interviews – in process…

Framework model under construction

Thank You Questions and comments appreciated