Managing Risks, Countering Threats: Protecting Critical National Infrastructure Against Terrorism Martin Rudner Canadian Centre of Intelligence and Security Studies The Norman Paterson School of International Affairs Carleton University

CRITICAL NATIONAL INFRASTRUCTURE PUBLIC GOODS & SERVICES PUBLIC GOODS & SERVICES PRIVATE OWNERSHIP/OPERATORS PRIVATE OWNERSHIP/OPERATORS INTERDEPENDENCY INTERDEPENDENCY INTERNATIONAL LINKAGES /GLOBALIZATION INTERNATIONAL LINKAGES /GLOBALIZATION

CIP SECTORS ENERGY ENERGY TRANSPORTATION TRANSPORTATION TELECOMMUNICATIONS TELECOMMUNICATIONS DEFENCE & CHEMICAL INDUSTRY DEFENCE & CHEMICAL INDUSTRY FINANCE FINANCE WATER SUPPLY WATER SUPPLY PUBLIC HEALTH PUBLIC HEALTH FOOD FOOD GOVERNMENT GOVERNMENT

THREAT ASSESSMENTS AL-QAEDA TARGETING OF CRITICAL NATIONAL INFRASTRUCTURE AL-QAEDA TARGETING OF CRITICAL NATIONAL INFRASTRUCTURE STRATEGY STRATEGY EVOLUTION EVOLUTION OBJECTIVES OBJECTIVES AL-QAEDA OPERATIONS IN IRAQ AGAINST CRITICAL NATIONAL INFRASTRUCTURE AL-QAEDA OPERATIONS IN IRAQ AGAINST CRITICAL NATIONAL INFRASTRUCTURE REDEPLOYMENT/RETURN OF MUJAHIDEEN REDEPLOYMENT/RETURN OF MUJAHIDEEN AL-QAEDA OPERATIONS ELSEWHERE AGAINST CRITICAL NATIONAL INFRASTRUCTURE AL-QAEDA OPERATIONS ELSEWHERE AGAINST CRITICAL NATIONAL INFRASTRUCTURE LONDON, MADRID, TURKEY LONDON, MADRID, TURKEY SAUDI ARABIA SAUDI ARABIA JORDAN JORDAN BAB EL-MANDEB BAB EL-MANDEB OTHER TERROR TARGETING OF CRITICAL NATIONAL INFRASTRUCTURE OTHER TERROR TARGETING OF CRITICAL NATIONAL INFRASTRUCTURE COLOMBIA COLOMBIA NIGER DELTA NIGER DELTA SRI LANKA SRI LANKA ISRAEL ISRAEL

A DEFENSIVE APPROACH TO CRITICAL INFRASTRUCTURE PROTECTION FOCUS AT MICO-LEVEL, SINGULARITIES FOCUS AT MICO-LEVEL, SINGULARITIES REACTIVE, PASSIVE PROTECTION REACTIVE, PASSIVE PROTECTION GUARDS, GATES (AND GUNS?) GUARDS, GATES (AND GUNS?) PROTECTIVE SECURITY PROTECTIVE SECURITY HARDENING HARDENING ROBUST DESIGN/TECHNOLOGIES ROBUST DESIGN/TECHNOLOGIES REDUNDANCY REDUNDANCY EMERGENCY PREPAREDNESS EMERGENCY PREPAREDNESS ASSURANCE ASSURANCE MITIGATION MANAGEMENT MITIGATION MANAGEMENT

A RISK MANAGEMENT APPROACH TO CRITICAL INFRASTRUCTURE PROTECTION PUBLIC/PRIVATE LIABILITIES PUBLIC/PRIVATE LIABILITIES PARADIGMS OF RISK PARADIGMS OF RISK ACTUARIAL RISK ACTUARIAL RISK PROBABILITY ASSESSMENT PROBABILITY ASSESSMENT WICKED PROBLEMS WICKED PROBLEMS CONSEQUENCE MANAGEMENT CONSEQUENCE MANAGEMENT CRITICALITY AND INTERDEPENDENCE CRITICALITY AND INTERDEPENDENCE PRIORITIZATION/RESOURCE ALLOCATION PRIORITIZATION/RESOURCE ALLOCATION LOW RISK, CATASTROPHIC CONSEQUENCES LOW RISK, CATASTROPHIC CONSEQUENCES

A STRATEGIC APPROACH TO CRITICAL INFRASTRUCTURE PROTECTION PROACTIVE INTELLIGENCE-LED CIP PROACTIVE INTELLIGENCE-LED CIP IDENTIFY THREATS IDENTIFY THREATS EARLY WARNING EARLY WARNING PREVENT ATTACKS PREVENT ATTACKS INTEGRATED, ALL-SOURCE ASSESSEMENT OF THREATS INTEGRATED, ALL-SOURCE ASSESSEMENT OF THREATS DATA-MINING DATA-MINING NETWORK ANALYSIS NETWORK ANALYSIS OPERATIONAL PARTNERSHIPS: SECURITY MANAGERS - INTELLIGENCE – LAW ENFORCEMENT OPERATIONAL PARTNERSHIPS: SECURITY MANAGERS - INTELLIGENCE – LAW ENFORCEMENT CULTURAL SHIFT: FROM “NEED TO KNOW” TO “NEED TO SHARE” CULTURAL SHIFT: FROM “NEED TO KNOW” TO “NEED TO SHARE” THREAT BASED, DESIGNED PROTECTION THREAT BASED, DESIGNED PROTECTION

A STRATEGIC APPROACH TO CRITICAL INFRASTRUCTURE PROTECTION (CONT.) PUBLIC-PRIVATE SECTOR PUBLIC-PRIVATE SECTOR PRIVATE SECTOR LIABILITY PRIVATE SECTOR LIABILITY INFORMATION SHARING INFORMATION SHARING INFORMATION PROTECTION INFORMATION PROTECTION STANDARDS FOR PROTECTIVE SECURITY STANDARDS FOR PROTECTIVE SECURITY COUNTER-PENETRATION ALERTNESS COUNTER-PENETRATION ALERTNESS RESILIENCE PLANNING RESILIENCE PLANNING INTERNATIONAL COOPERATION INTERNATIONAL COOPERATION TRAINING REQUIREMENT TRAINING REQUIREMENT

LESSONS THAT NEED TO BE LEARNED Gaps in protection represent vulnerabilities to determined terrorists Gaps in protection represent vulnerabilities to determined terrorists Terrorists will exploit any chink in our armor Terrorists will exploit any chink in our armor There will always be chinks in the armor of an open society There will always be chinks in the armor of an open society National Security Policy for CIP to ensure: National Security Policy for CIP to ensure: that cost to adversaries of trying to exploit these chinks is high that cost to adversaries of trying to exploit these chinks is high their prospects of success minimal their prospects of success minimal potential consequential damages are mitigated, and that our Critical National Infrastructure has a pre- planned capacity for resilience. potential consequential damages are mitigated, and that our Critical National Infrastructure has a pre- planned capacity for resilience.

THE ETHIC OF WARNING “On issues of life and death the intelligence officer must always err on the side of the threat and not on the side of the optimist. Even if the threat is classified as being of low probability, it must be perceived as real and immediate. This is especially so if the penalty of a mistake would result in the deaths of thousands, major economic catastrophes, and … social upheaval…” “On issues of life and death the intelligence officer must always err on the side of the threat and not on the side of the optimist. Even if the threat is classified as being of low probability, it must be perceived as real and immediate. This is especially so if the penalty of a mistake would result in the deaths of thousands, major economic catastrophes, and … social upheaval…” -Efrain Halevy -Efrain Halevy