1Georgia Institute of Technology 2Chicago Booth School of Business Economic Decision Analysis: Network Effects of Disasters on Critical Infrastructure Eva K Lee1 John R Birge2 1Georgia Institute of Technology 2Chicago Booth School of Business Atlanta, GA Chicago, Il Problem Statement and Objective: Private industry owns and operates approximately 85 percent of the nation’s critical infrastructures and key assets. DHS NPPD tries to influence private sector actions via various mechanisms, including regulations, incentives (e.g., grants), public-private partnership, and legislation to foster integrated, collaborative engagement and interaction that are essential to maintaining critical infrastructure security and resilience. Objectives: Prioritize networks that enable critical lifeline functions. Investigate best practice and identify/establish standards and assurance mechanisms for Tier I assets Leverage analytic tools to protect/harden/incentivize protective measures Methodology and Data Requirements Apply inverse optimization, game-theory, and network effect analysis on CI under attack Perform Multi-objective portfolio optimization to analyze tradeoffs to help prioritization,. Synthesize recommendations/measures to harden CI Simulate systems to understand effectiveness of measures Data requirement Collect / investigate current private sector protection guidelines Work with DHS to identify current DHS standards and guidelines Impact Statement and Relevance to DHS Roles and Responsibilities As conduit for state, local, tribal, and territorial and private sectors to the federal enterprise, DHS shall promote actions to promote protection of critical infrastructures against physical, cyber, natural and man-made disasters to promote economic and domestic resilience. Impact to DHS: Improved understanding of network protective capability and current best practice; improved resilience through new protective measures; improved relationship / partnership with private sectors. DHS lead: George Bamford Director, Strategic Infrastructure Analysis Division OCIA, NPPD Timeline and Deliverables 20 days: Complete workplan, 60 days: Complete component visits 120 days: Complete review with customers (include telecomm.) 6 months: Obtain current private sector protection guidelines, DHS recommended standards 9 months: Establish standards and assurance mechanisms for Tier I assets, identify beat practice 12 months: Complete network effect analysis on CI under attack 15 months: Complete portfolio analysis of tradeoffs for prioritization 18 months: Report measures / recommendations to harden CI 21 months: Complete economic analysis on effectiveness of measures 24 months: Refine measures and assurance mechanisms