critical infrastructure protection case study

The Journal of the NPS Center for Homeland Defense and Security

Questioning the Criticality of Critical Infrastructure: A Case Study Analysis

By David Riedman

The Department of Homeland Security holds the statutory mission to protect the nation’s critical infrastructure which is composed of nationally significant systems and assets. The loss of this infrastructure would result in debilitating consequences to the safety and security of the United States. Based on a meta-analysis of government policies, the current critical infrastructure protection efforts may be misdirected even though it is the cornerstone mission of the department to prevent terrorism and enhance security. Even when a facility is destroyed, the consequences may be more complex than a blanket mission of protecting all facilities against all threats and hazards can address. These findings can justify reducing the scope of the current infrastructure protection mission by assuming a greater level of resilience within complex systems and adopting a risk-based methodology for evaluating only the infrastructure that would cause debilitating impacts on the safety and security of the nation.

Suggested Citation

Riedman , David.   “Questioning the Criticality of Critical Infrastructure: A Case Study Analysis.” Homeland Security Affairs 12, Essay 3 (May 2016). https://www.hsaj.org/articles/10578

Introduction

Terrorist attacks can shake the foundations of our biggest buildings, but they cannot touch the foundation of America. These acts shattered steel, but they cannot dent the steel of American resolve. — President George W. Bush, September 11, 2001 1

The literal foundations of the United States are the critical infrastructure (CI) systems that provide essential-to-life services on which the American people are dependent. DHS asserts that these CI systems are “so vital to the United States that their incapacitation or destruction would have a debilitating effect on security, national economic security, national public health or safety, or any combination thereof.” 2 Even after the Twin Towers fell, America remained capable of functioning, and President Bush said that night, “the functions of our government continue without interruption…our financial institutions remain strong, and the American economy will be open for business, as well.” 3

While the attack had caused fear and disruption, it had not crippled an enormously complex and resilient national system of infrastructure facilities. If terrorists cannot damage the functionality of America (even on the local level) by toppling 100-story commercial high-rise buildings, what kinds of facilities would have a debilitating impact on the entire nation if they were destroyed?

This article presents portions of the Center for Homeland Defense and Security (CHDS) Master’s Thesis “How Critical is Critical Infrastructure?” which explores the idea that not all infrastructure designated as critical meets the definition of criticality; sometimes when supposedly critical infrastructure, especially commercial facilities, are damaged or destroyed, it turns out the facility was not critical after all. The overall systems of essential-to-life infrastructure across the country are more resilient than the current methodologies presuppose.

This research is a meta-analysis of government policies on infrastructure protection intended to address the question of how these facilities became designated as critical and whether the scope of the current infrastructure protection effort is inhibiting the department’s ability to accomplish the mission. This research is limited to the risk evaluation, vulnerability assessment, and protection of physical infrastructure facilities.

Definition of “Critical Infrastructure”

Federal government reports, plans, policies, and directives from the 1980s to today emphasize that CI is comprised of the interconnected systems that can cause debilitating impacts to the safety and security of the nation if they are destroyed by natural disasters or terrorism. Key documents in defining this protection mission have included President Clinton’s Executive Order 13010 , the USA PATRIOT Act , Presidential Policy Directive 63 , multiple iterations of the National Critical Infrastructure Protection Plan (NIPP), and the 2014 Quadrennial Homeland Security Review . As the concepts within the policies have developed over time, the definition of CI has remained focused on those nationally significant systems and assets, the loss of which would result in debilitating consequences to the safety and security of the United States.

As demonstrated by Table 1, thirteen overarching federal government policies released over the past 19 years consistently describe critical infrastructure as being nationally significant, providing vital services, being part of an interconnected system, causing debilitating impacts if destroyed, and providing a service necessary to the health and safety of the general public.

Table 1. Analysis of Definitions of Critical Infrastructure

DHS currently provides a wide-ranging list of facilities within 16 different sectors that are considered to be critical. 4 Based on this analysis, infrastructure that lacks national significance, criticality, and interconnectedness to other infrastructure systems does not meet this definition. This creates a discrepancy between the federal policies that define critical infrastructure and how DHS currently addresses its statutory infrastructure protection mission to identify, prioritize, and protect the nation’s most vital infrastructure. 5

Federal government documents over the past 35 years have a consensus in their definition of CI being the systems and assets that are nationally significant, the loss of which would result in debilitating consequences to the safety and security of the United States. This represents a significant incongruence between the federal policies which define CI and the way DHS currently views infrastructure facilities. While DHS takes an all-inclusive approach to include as many facilities as possible under the designation as “critical,” CI has consistently been defined as only the systems that are nationally significant. This problem is apparent when looking at the commercial facilities sector due to the measures of criticality that relate to physical attributes of the facilities, but which do not relate to nationally significant essential-to-life services or maintaining economic security.

To challenge the current CI protection policies relating to commercial facilities further, case studies of the World Trade Center (WTC) and the Las Vegas Strip raise questions regarding general assertions of the negative economic impact occurring after the destruction of a “critical” commercial facility. A case study of the 2014 toxic chemical spill into the primary water source serving Charleston, West Virginia also provides an example that is contrary to the argument that the loss of a facility serving as sole provider of an essential-to-life service results in debilitating impacts across all infrastructure sectors within a local area.

Case Studies of Seemingly Critical Facilities

The facilities that DHS designates as CI should cause debilitating impacts to the nation if destroyed, but what if the loss of these facilities did not even have a debilitating impact on a local level? The destruction of the original WTC, the destruction of 14 Las Vegas Strip casinos, and the chemical contamination of the sole water source in Charleston, West Virginia did not result in debilitating local impacts. Surprisingly, the New York and Las Vegas cases actually lead to positive economic impacts at the local level.

It should be noted that the loss of human lives can occur with the destruction of critical facilities, but the IP mission is not always focused on reducing human losses. In 2013, 32,719 traffic collision fatalities occurred on roadways 6 that fall under the CI transportation systems sector, but it is the mission of DHS to protect the physical transportation infrastructure from terrorist attacks rather than investing resources to prevent thousands of annual deaths from occurring during vehicle accidents on the highways. 7 It is within the scope of the DHS mission to assess how a bridge could be attacked with explosives by terrorists, but not to assess if installing higher guardrails could prevent a car from accidently driving off the bridge.

The commercial facilities sector is an example of facilities currently deemed to be CI, but the analysis within the following case studies shows that the buildings were not essential to the nation, not single points of failure, and not providing functions upon which other infrastructure systems were dependent. These commercial facilities are not critical due to redundant and resilient functions within this sector. As the analysis of the Lower Manhattan office market demonstrates, resiliency occurs within the subsectors, and as a result, the impacts from facility losses were not nationally, regionally, or even locally significant. In New York, when office buildings were destroyed by the 9/11 attacks, others were readily available to absorb the demand for office space within the local market.

Refining the methodology for how facilities are categorized as critical, or not critical, can reduce the total number of CI facilities and the overall complexity of evaluating infrastructure. Removing the “critical” designation from facilities that do not cause national devastation or cascading effects to other infrastructure when destroyed can be beneficial by allowing DHS to refocus resources on fulfilling the department’s statutory mission of protecting essential infrastructure systems.

Case Study 1: How the Loss of World Trade Center was Critical to Redeveloping Lower Manhattan

The large brokerage houses that once lined Wall Street and its cavernous side streets have spread far and wide in Manhattan, a reflection of how the area south of Chambers Street is no longer the dominant financial services center it once was. With aging buildings that cannot accommodate huge computers, and a declining need for financial companies to be near each other, The Street and its neighborhood are mere reminders of what they once were. — New York Times, 1994 8

A steady exodus of banks, brokerage houses and insurance companies in recent years has left the capital of capitalism struggling at the very moment the economic system it epitomizes is sweeping the planet. — Boston Globe, 1996 9

I think it is inevitable that Downtown [Lower Manhattan] will reinvent itself once again. The process is already underway, and I am very optimistic about its future. — David Rockefeller, 2002 10

“It’s 1 World Trade Center’s stunning combination of ultra-modern design and super-sustainable efficiency that makes it a truly towering achievement.” — WTC.com Marketing Material, 2015

Before September 11, 2001, twin landmark towers stood over the New York City skyline (Figure 1), but many of today’s amenities that make Lower Manhattan one of the most valuable real estate markets in the world did not. No Fulton Street Transit Center existed to organize a jumble of train lines and buses. A walkable park hosting more than 500 free concerts and waterfront condominiums stretching along the Hudson River also did not exist. The Downtown Connection bus line did not bring 800,000 annual riders to the area. Thirty billion dollars in combined public and private investment was not available to transform the aging WTC into a gleaming Class-A Leadership in Energy and Environmental Design (LEED) Platinum 11 property. Visitors now stay in nearly 8,000 hotel rooms, which is triple the number that existed before 2001. 12

The 9/11 attacks were the largest loss of life in American history from terrorism and a major national tragedy. But out of the rubble, the economic landscape of Lower Manhattan transformed in a manner that would never have been possible without the total loss of the WTC.

Figure 1. New York City Skyline in 1995 and 2014. 13

Commercial Real Estate in Manhattan

Manhattan is now one of the largest commercial office markets in the world. According to 2014 tax records, 1,941 commercial office buildings are valued at $95.6 billion. 14 In 2000, it was assessed at $42.9 billion 15 ($58.9 billion adjusted to 2014 inflation 16 ), which shows the property values have almost doubled in the last 13 years since the 9/11 attacks, as illustrated in Figure 2.

While the destruction of the WTC caused a major impact to the area, things were not in great shape prior to the attack. The year 1995 was the lowest point in a troubled decade for Lower Manhattan. Nineteen of the 20 largest stock brokerage houses had closed, 18 of the 20 largest advertising firms had left, and only seven of the original 35 Broadway theaters remained open. Thomas Leuck described the situation thusly,

[t]he flight of major brokerage houses and investment banks has left the neighborhood burdened by old office buildings, with nearly a quarter of their space vacant, and with their prospects of luring tenants undermined by small floors, poor ventilation and wiring, and outdated architecture. Now, while they still need larger and more modern buildings than can be found on the blocks around Wall Street, the priority of many of the securities companies is to find the best deals they can strike on corporate real estate, with few reservations about moving off the beaten path in Manhattan. 17

Figure 2. Assessed Property Values in Lower Manhattan between New York City Fiscal Year 1991–2000. 18

Tax incentives and large amounts of vacant office space allowed tenants outside the financial industry to move into Lower Manhattan. In 1996, major tenant additions included American Airlines, Pfizer Inc, and Gruner & Jahr USA Publishing. Mayor Giuliani’s Wall Street revitalization plan also called for converting office spaces into residential properties. Vacancy rates still remained around 70% and the square footage rate for the American Airlines 15-year lease was only $33 ($45.3 adjusted to 2014 inflation) per square/foot (the new WTC is currently leasing for $72/ft). 19

At the center of the changing office market, which was transitioning from stockbrokers and advertising to a variety of international businesses, was the WTC towers. The Twin Towers were designed and built during the heyday of big Wall Street brokerage houses and included 7.6 million square feet of space, which were not designed for computers and modern office amenities. In 1995, the WTC had a 25.1% vacancy rate, which meant that nearly 2 million square feet of space was vacant (an entire 40-story high-rise building of empty space). 20 The enormous amount of vacant space at the WTC negatively impacted real estate and rental prices throughout the entire area.

Loss of the World Trade Center

In the aftermath of 9/11, without the WTC (original or new), the office space market in Manhattan was well positioned for growth. The immediate aftermath of the 9/11 attack caused fear across the American public but did not deter citizens and businesses from quickly returning to Ground Zero. In 2004, the City of New York Independent Budget Office forecasted that office employment would regain the peak it had reached in 2000 by 2010. It appeared that currently vacant space, as well as space expected to come on-line during the 2005–2010 period (i.e., Time Warner Center, 1 Bryant Park, the New York Times building, and the Bloomberg building) would be sufficient capacity to accommodate the new workers even while the trade center buildings remained under construction. 21

According to the Independent Budget Office,

the destruction of the World Trade Center and damage to surrounding buildings removed roughly 30 percent of the downtown Class-A office inventory. Contrary to expectations, this loss did not result in a spike in rents caused by the precipitous decline in supply. Instead, the spreading impact of employment losses due to the local recession that had started in the spring of 2001 and accelerated after the attack, combined with the existence of leased but unoccupied ‘shadow space’ in midtown and downtown, enabled the real estate market to absorb most of the displaced tenants with little effect on rents. Instead, downtown vacancies grew and rents fell during 2002 before stabilizing somewhat during 2003 and 2004. 22

As demonstrated by Figure 3, commercial office leasing peaked in 2002 following the loss of the WTC and the need to secure new office spaces. Above average leasing continued in 2003 and 2004. As the new WTC and other redeveloped Lower Manhattan properties have opened, office-leasing activity peaked in 2013 and 2014.

Figure 3. Lower Manhattan Commercial Leasing Activity 2001–2014. 23

Creating New Markets

The criticality of an individual facility, even an enormous commercial facility like the original WTC, is nearly impossible to evaluate because even though it seems to be counterintuitive, the destruction of the old WTC allowed for the creation of a more valuable facility.

The original seven building WTC site contained 11.2 million square feet of office space, which accounted for 4% of the total office inventory in all of Manhattan. 24 If the original WTC were 100% occupied with the hotel maintaining peak average occupancy, the combined site properties would generate a maximum of approximately $545 million in annual revenue, as demonstrated in Table 2.

Table 2 . Original World Trade Center Maximum Leasing Revenue Estimate

To attract tenants from multi-national corporations, and compete with surrounding properties, premium commercial offices are designated as “Class A.” Office space rental prices are grouped in three classes by the Building Owners and Managers Association International (BOMA). The classes include:

• Class A—Most prestigious buildings competing for premier office users with rents above average for the area. Buildings have high quality standard finishes, state of the art systems, exceptional accessibility, and a definite market presence.
• Class B—Buildings competing for a wide range of users with rents in the average range for the area. Building finishes are fair to good for the area and systems are adequate, but the building does not compete with Class A at the same price.
• Class C—Buildings competing for tenants requiring functional space at rents below the average for the area. 25

By today’s standards, the original WTC, which was built in the 1970s, would likely not meet the criteria for a Class A building, and subsequently, would not demand the highest rates and draw the premier tenants paying top dollar. The new WTC is designated “Class A” and if the buildings are 100% leased, the total leasing revenue will exceed $1 billion annually (Table 3).

Table 3. New World Trade Center Maximum Leasing Revenue Estimate

The new WTC buildings have the potential to generate $250 million more in annual revenue than the old buildings. This total would likely be much higher because the old Twin Towers would struggle to compete with surrounding premium office spaces or the excess office space across the entire Lower Manhattan office market would collectively drive down property values. Instead, the new WTC buildings are the cornerstone of the revitalized Lower Manhattan office market.

Cost of 9/11 Attack versus Economic Impacts of Redevelopment

A 2002 study by the Federal Reserve Bank of New York Economic and Policy Review estimated the total losses from the 9/11 attacks including earning losses, property damage, and cleanup to be between $33 and $36 billion. 26 Of those losses, the physical losses shown in Figure 4 total $21.6 billion.

Figure 4 . Measuring the Effects of the September 11, 2001 Attack on New York City. 27

While the loss totals appear to be staggering, they are dwarfed by the positive economic impacts of the redevelopment, which were estimated to be $15.7 billion annually (direct, indirect, and induced) in a study produced for the Lower Manhattan Development Corporation, as shown in Figure 5. 28

Figure 5 . Economic Impact of Redeveloping the World Trade Center Site. 29

WTC Case Study Conclusion

The loss of life at the original WTC was a tragic event, but with it, the sudden disappearance of the original WTC buildings caused a significant decrease in total square-footage of available office space, which served to stabilize an oversaturated and declining commercial real estate market in Lower Manhattan. Fear of future attacks did not deter people and businesses from returning to Lower Manhattan either. Through public and private investment, the new WTC has been constructed to be more efficient in a design that meets the office market demands of premium clientele in Manhattan. The smaller but more luxurious office footprint draws nearly double the price per square-foot and provides more retail, transit, cultural, and public spaces for the general consumer.

The $21.6 billion estimate of the capital losses 30 ($16.4 in physical buildings) associated with the 9/11 attack only represent direct losses impacting the WTC itself. CI is defined by the interconnectivity of the systems within each sector and across multiple sectors. Manhattan has an estimated $804.4 billion office market with 32.8 million square-feet of office space. Compared to the overall office market, the loss of the WTC represented 2% of the total commercial office building value while also being 29% of total office space (in an oversaturated market). 31 In addition to stabilizing the office leasing market, redevelopment has transformed the mid-1990s Lower Manhattan market, which did not offer premier real estate, luxury shopping, world class hotels, destination dining, and tourism, into an area that produces cumulative consumer spending of $5.2 billion annually according to the 2014 Lower Manhattan Real Estate Market Overview produced by the Alliance for Downtown New York. 32

The 2006 Homeland Security Advisory Council—Report on Critical Infrastructure Task Force reported that the impacts of terrorism and 9/11 extended “well beyond the direct ‘ground zero effects’ and were exacerbated by citizens’ choices based on their altered perception of risk. Ultimately, the ability of CI to recover fully from a catastrophe depends on the actions of the consumers.” 33 The exact “ground zero” location of the 9/11 attack has become a tourism destination of itself. The 110,000-square-foot National September 11 Memorial Museum was initially expected to draw 2.5 million visitors per year, but exceeded 500,000 visitors during the first two months of operation in May and June 2014. 34 The number of hotel rooms in Lower Manhattan near the location of the attacks has tripled since 2001, which demonstrates significant interest as a destination for tourists (Figure 6).

Figure 6 . Number of Hotel Rooms in Lower Manhattan. 35

The loss of the original WTC is a case that is opposite to the principles of a facility being “critical infrastructure.” Rather than causing debilitating and cascading negative impacts to the nation or surrounding region, the loss of the buildings was a net-positive to the components of the commercial facilities sector in Lower Manhattan. It is unlikely that a viable plan would have been available to demolish and rebuild the WTC without an unplanned event destroying it. Without the 9/11 attack, the continued existence of the original Twin Towers would have resulted in sustained over-saturation of the Manhattan office market with an excess amount of outdated and undesirable Class B office space. Over the past decade, the office market pressure has continued to grow for LEED Certified and Green Office space, which would have continued to decrease the price per square-foot at the WTC as surrounding buildings drew away Class A customers. 36 The enormous amount of office space within the original Twin Towers would have likely continued to depress the surrounding market and economic growth, and deter capital investment into the area.

The original WTC buildings and commercial facilities in general should not be considered “critical infrastructure” because commercial markets are too complex with numerous contributing variables for DHS or a group of industry representatives to make assumptions that individual facilities are supremely important. It is very unlikely that anyone would have said the largest building in New York City was not critical, but the destruction of it paved the way for massive redevelopment and economic growth, as seen in Figure 7.

Figure 7. 1 World Trade Center Website. 37

While it was unforeseeable at the time, the Lower Manhattan area that was most heavily impacted by the September 11, 2001 attacks is more valuable today and better positioned for the future than it was prior to 2001. If terrorists cannot cripple this nation by toppling 100-story commercial high-rise buildings, what kinds of facilities would have a debilitating impact on the entire nation if they were destroyed? Instead of being designated “critical,” the majority of infrastructure facilities are insignificant to the functions of the overall system because the loss of these facilities does not cause widespread disruptions to the nation, region, or even the local area. The worst circumstances may spur the greatest opportunity for positive change, which could shift homeland security strategies to focus primarily on effective recovery rather than protecting existing systems.

Case Study 2: Las Vegas Casinos and Critical Infrastructure

The National Strategy for the Physical Protection of Critical Infrastructure and Key Assets assigned DHS with the responsibility to “ develop a uniform methodology for identifying facilities, systems, and functions with national-level criticality to help establish protection priorities; build a comprehensive database to catalog these facilities, systems, and functions; and maintain a comprehensive, up-to-date assessment of vulnerabilities and preparedness across critical sectors.” 38

Below the national level, DHS’s Regional Resiliency Assessment Program evaluates clusters of CI and key resources within a geographic area. In a regional geographic area, jurisdictions have different interpretations of the types of facilities critical to their jurisdiction, to the larger region and the nation. According to a DHS grant funded study, Clark County: Critical Infrastructure and Key Assets , produced by Urban Environmental Research,

[t]he protection of the nation’s infrastructure assets (or critical infrastructure) from disruption and destruction is a primary function and concern of all levels of government. Clark County, internationally known for the Las Vegas Strip and lavish casino entertainment (Figure 8), is unique in that the structure of the local economy is built primarily on gaming. In the evaluation of critical assets in Las Vegas, Nevada, the most important assets are clearly the casinos and glitter of the Strip. 39

Presidential Policy Directive/PPD-21 defined CI as the “systems and assets, physical or virtual, so vital to the United States that the incapacity or destruction of such systems and assets would have a debilitating impact on security, national economic security, national public health and safety, or any combination of those matters.” 40 The Clark County: Critical Infrastructure and Key Asset report describes the international and national significance of Las Vegas and The Strip’s casinos as the most critical assets, but are these commercial facilities even critical at the local level?

Figure 8.  Image of the ‘Fabled’ Riviera Casino That Closed on May 4, 2015. 41

What Gaming Facilities Subsector Members Expect from DHS

The National Infrastructure Protection Plan: Commercial Facilities Sector—Annex 2: Gaming Facilities Subsector describes the facilities in the sector as soft targets vulnerable to the public’s fear and perceptions of security. To protect casinos from potential terrorist attacks, the costs of making physical changes are significant and a need exists for tax incentives to reduce the economic burden on owners for making improvements. The goal of the subsector is to “implement security measures that are efficient, cost-effective, and as unobtrusive as possible.” 42 Across the gaming subsector, facilities have “expressed concerns over sharing assessment information with the Federal Government for any initiative that makes formal decisions on the prioritization of assets (i.e. concluding that one asset is more ‘at risk’ than another).” 43

The gaming subsector cites $5.6 billion in direct gaming tax revenue as the justification for federal resources and protection as CI facilities, but the requests of the subsector council include tax incentives, which would reduce this revenue. To distribute resources across 445 facilities effectively, DHS must make a determination of risk, priority, and criticality, but the gaming subsector also does not support any effort to document one facility as more important than others. 44

Las Vegas Casinos

In planning for protection of a CI facility such as a Las Vegas casino, protective measures would address the use of explosives by terrorists to damage or destroy the building. Since the economic depression in 2006, explosives have destroyed many of The Strip’s “critical” casinos, but these explosives were planned detonations to implode vacant buildings intentionally. Since 2006, the Castaway, Boardwalk, Bourbon Street, Stardust, New Frontier, and Klondike casinos have all been imploded. During the same time period, the Lady Luck, Sahara, Western, O’Shea’s, Gold Spike, and Riviera casinos have all closed. 45 The implosion of six casinos and the closure of six others over the last decade means that 12 of Las Vegas’ 87 casinos (currently 75 are open), or 14%, of these CI facilities have been lost. 46 The loss of a critical facility should result in debilitating impacts to the nation, so how has the loss of 12 critical facilities impacted the local area in Las Vegas?

From 2005 to 2013, the population of Las Vegas has increased from 544,608 to 603,448 (Figure 9). Real per capita income increased slightly from 2005–2007 before dipping to 15% lower than pre-casino closures at $25,918 in 2013 (Figure 10). Residential rental rates have remained fairly constant over the same time period (Figure 11).

Figure 9 . Population of Las Vegas, NV by Year. 47

Figure 10 . Nevada Real Per Capita Income per Year. 48

Figure 11 . Monthly Rental Rates Las Vegas by Year. 49

In Las Vegas, the casinos are considered to be critical facilities, which would result in debilitating impacts to the local economy if they were destroyed, but as 14% of the casinos were imploded or closed, the population of the city increased while median rental prices and incomes remained fairly constant.

The casinos that have closed permanently or been demolished in Las Vegas had previously been cornerstones of The Strip. The most recent facility to close is the Riviera Hotel and Casino, which was the first high-rise built in the area in 1955, and which included 2,100 hotel rooms. The hotel featured A-list celebrity guests, professional boxing title fights, and performers including Elvis Presley and Louis Armstrong. 50 While 1,200 employees at the Riviera lost their jobs, more than 950,000 of 1,029,700 51 employable people in Las Vegas remain employed, maintaining an unemployment rate of 7.2%, which is just over the national average of 5.4%. 52

If the loss of “critical infrastructure” casinos in Las Vegas did not result in widespread detrimental impacts to the city, should these facilities be considered to be “critical infrastructure” to Clark County, Nevada? If the impacts of the closures were negligible at the local level, it is unlikely that these casinos have any regional or national implications to CI.

Resiliency within the Las Vegas Casino Industry

While the Clark County: Critical Infrastructure and Key Asset report describes The Strip’s casinos as the most critical assets, it is not the individual physical properties that are critical, it is the overall gaming industry that is essential to the city. The individual properties are not critical, as shown by the 12 casinos closed between 2006 and 2015 without causing major disruptions to the tourism industry (Figure 13), hotel occupancy (Figure 13), or gaming revenue (Figure 12). When DHS determines how to spend federal funding for providing protection to CI, not a single casino needs protective measures, and it would be prohibitively expensive to protect every casino against all threats. In a terrorist attack scenario, simultaneously destroying all 80 casinos on the Las Vegas Strip would be the largest terrorist attack in world history, and is very unlikely to occur. The gaming industry in Las Vegas is already “protected” by the resiliency within the network of eight casinos along The Strip. An attack against a single casino, or group of casinos, would not cause the entire gaming industry to crumble because the loss of 12 casinos to closure has not significantly impacted key indicators (visitors, hotel occupancy, and tax revenue). An attack across the entire industry is not realistic. In other words, the protection of the key asset (gaming industry) already exists within the current system without additional assistance from federal funding and resources.

Figure 12 . Annual Tax Revenue of Las Vegas Strip Casinos 2001–2012 via University of Las Vegas Center for Gaming Research. 53

Figure 13.  Las Vegas Visitor Statistics from Visitor and Convention Authority. 54

The Clark County: Critical Infrastructure and Key Asset report also describes that a terrorist attack would deter visitors from traveling to Las Vegas, which would be extremely detrimental to the hotel and gaming industry. Following the 9/11 attacks in New York City, annual tourism has increased every calendar year since 2001. In 2013, 54.3 million people visited New York City, which is 16 million more than 2000 (36.2 million). 55 The exact site of the terrorist attack has also drawn 19 million visitors to the 9/11 Memorial since it opened in 2011, which suggests that a terrorist attack occurring at a facility is not necessarily a deterrent to future visitors. Furthermore, a memorial for the attack may become a tourist destination in itself.

Individual Gaming Facilities are Not Critical Infrastructure

At the federal level, the gaming facilities subsector uses total gross revenue and tax revenue as the justification for the inclusion of casinos as CI. The DHS gaming subsector also does not identify individual facilities as being more or less critical than other gaming facilities. Choosing not to delineate importance (based on revenue, economic impact, tax base, population, or any other measure) aligns with the concept of the resiliency that has been demonstrated across the Las Vegas Strip casinos. No individual casino in the country has significant impacts on the gaming industry at the local, regional, or national level. A network of hundreds of gaming facilities provides a variety of gambling options even if specific locations are unavailable due to business closure, a terrorist attack, or any other reason. This resiliency within the gaming subsector buffers disruptions and allows for a steady generation of revenue without the need for federal resources to be dedicated to the protection of specific gaming facilities.

Case Study 3: Scarcity of Function and a Single Point of Failure for The Charleston, West Virginia Water Supply

Clean water is essential to human survival across the world. A mix of public and private utilities provide water services in the United States, and protection of these critical services falls under the DHS CI water sector. Loss of water services causes both an immediate risk to human health and cascading impacts across other CI sectors dependent on water services. 56 Prioritizing the protection of water infrastructure on the nationwide level is described in the 2010 NIPP Water Sector Specific Plan through the evaluation of “higher-consequence and higher-priority utilities.” The plan further specifies that “four criteria are used to better identify these national level high-consequence assets: (1) population served; (2) amount of chlorine gas stored on site; (3) economic impact; and (4) critical customers served.” 57

In January 2014, a toxic chemical spill of 10,000 gallons of 4-methylcyclohexanemethanol contaminated the Elk River one and half miles upstream of the City of Charleston in West Virginia. This spill resulted in the total contamination of water services (drinking, washing, bathing) to 300,000 residents in nine counties. 58

Public water utility service was the primary source of water for the majority of the residents in the area:

• 17.6% of residents reported having rainwater and 5.6% reported well water available, which resulted in the majority of residents requiring bottled water because tap water was not available.
• 37% of residents reported using tap water during the “do not use” order, which showed that adequate supplies of bottled water were not available for all water related activities including showering/bathing.
• 78.8% of users during restriction showered/bathed with contaminated water. 59

The chemical spill into the Elk River is an example of both a scarcity of function and a single point of failure in an infrastructure system. Municipal water service was the primary provider of clean water (an essential-to-life service) for the residents of Charleston and the surrounding counties. Without the municipal water service, a scarcity of function occurred because other sources were unable to provide adequate supplies of the necessary service to the population. The upstream contamination represented a single point of failure in the water service system because no alternate source was available from which the water treatment facility and water system could draw. The chemical spill into the sole water supply for the majority of citizens caused the entire water service infrastructure to fail.

This failure of the water infrastructure system is an example of a CI system critical to the local jurisdiction. The lack of water services in an isolated area was not regionally or nationally significant to water infrastructure systems. The lack of water to this isolated area was also not debilitating to the region or the nation. This example is useful for studying scarcity of function and single points of failure in a CI system.

Currently, DHS measures the consequences of loss of water services by evaluating the public health effects, economic impacts, psychological impacts, and interdependencies and dependencies with other infrastructure sectors. 60 It seems more useful to evaluate the criticality of water systems through the scarcity of the water infrastructure function and the existence of a single point of failure in delivery of the service. At a local and regional level, resiliency in the delivery of essential services exists across infrastructure sectors. In the West Virginia chemical spill, regional and national systems provided bottled and trucked water in an effective manner to meet service demands.

The Charleston outage is useful for evaluating the loss of single sources of essential functions at the national level. The Hoover Dam is the sole provider for water service to 1.3 million citizens. 61 The Hoover Dam also holds back a 9.2 trillion gallon 62 reservoir that would require a million gallons of a toxic chemical to contaminate. In West Virginia, the mining industry positioned 10,000 gallons of a dangerous chemical near a waterway but no million-gallon storage tanks of toxic chemicals are positioned directly around the Hoover Dam. It is also not a viable scenario for a terrorist group, or other enemy, to transport millions of gallons of a toxic chemical to a nationally significant water source. It would take 20,000 tractor-trailer trucks carrying 5,000 gallons of a chemical to amass one million gallons of a contaminant. Even if the Hoover Dam were somehow contaminated with a chemical, it would likely have minimal impact on its ability to generate four billion kilowatts of power, 63 and the subsequent functions of other infrastructure sectors dependent on it for water.

Figure 14.  Interdependencies with Water Sector Infrastructure from National Infrastructure Protection Plan. 64

On the national level, do sole providers and single points of failure exist in CI systems and services? If they do exist, how large is the scale of the disruption needed to break the system? For example, what volume of toxic chemicals would be needed to contaminate the Hetch Hetchy Water System that serves 1.7 million citizens 65 in San Francisco, CA? Would an accidental or intentional release of that volume of chemicals be viable? It is likely not a viable scenario. In the local case of the Charleston spill, water for drinking, cooking, and bathing was impacted but did the contamination have any impact on other infrastructure systems, such as electrical power, telecommunications, transportation, petroleum liquid, or natural gas as shown in Figure 14 from the National Infrastructure Protection Plan ? A drinking water outage is not necessarily an outage of all water uses across every infrastructure function that uses water as a component.

The January 2016 FEMA Emergency Declaration 66 issued for lead contamination in the water supply of Flint, Michigan further emphasizes this concept that the total loss of a seemingly critical system does not instantly cripple all infrastructure functions in the impacted area. There is enough redundancy within regional and national infrastructure systems to provide essential water services through bottled water, federal assistance to serve as a stop gap to defer the cost of bottled water, state assistance to repair the municipal water system, and public-private infrastructure services to reconnect the Flint area to Detroit’s water system as a temporary solution. 67

Findings and Recommendations

The concepts presented within this article suggest that DHS is failing to fulfill the mission of protecting the infrastructure that is critical to the nation by expending resources on misaligned efforts at thousands of insignificant facilities. On a local and regional level, redundancy and resiliency occur across infrastructure systems that allow affected areas to absorb outages and unaffected areas to provide alternative services. As a backstop, national emergency response capabilities can quickly deliver essential services during outages, such as the bottled water supplied to Charleston, WV following the chemical spill into the water supply. Also, the enormous complexity within infrastructure systems makes predicting the impacts of outages extremely difficult, as demonstrated by the unanticipated economic gains in Lower Manhattan following the 9/11 attacks.

While infrastructure systems are interdependent, redundancy and resiliency also occur, which allows the larger systems to continue functioning during disruptions. Resiliency, or the ability of a facility to continue functioning, is the opposite of criticality. The ability of resilient systems to resume or continue functioning is the opposite of the failures and breakdowns in systems that DHS uses to frame the definitions of CI. This concept of resilience follows the National Infrastructure Protection Plan , which states that, “resilient infrastructure systems are flexible and agile and should be able to bounce back after disruption.” 68 Within the resilient systems, disruptions that occur may cause beneficial changes. Policies centered on guarding a vast array of facilities from all types of risks potentially have the negative impact of preventing progress at the expense of protecting the status quo.

Additional research into CI failures following the same methodology as the case studies within this article could determine if negligible losses, or even positive gains, occurred in a variety of circumstances. Looking at property values, tourism, tax revenue, hotel occupancy, and average rental prices of New Orleans, LA 10 years prior to and 10 years following Hurricane Katrina would likely show that the post-disaster city has made positive economic gains that position it for a better future. Greensburg, KS was completely destroyed by an EF-5 tornado in 2007, but is now known to be a model green community because all the buildings have been built to the highest environmental certification and are wind powered. 69 It is unlikely that Greensburg would have become a national model of environmental sustainability without the tornado destroying all the town’s existing infrastructure. In August 2007, the I-35 Bridge over the Mississippi River in Minneapolis collapsed and traffic had to be rerouted until the replacement bridge opened in September 2008. The bridge would have been considered a critical component of the transportation infrastructure, but the resiliency within the system allowed for a mere traffic disruption rather than a catastrophic failure of the entire system occurring. 70 While sports stadiums and arenas are infrastructure considered critical to the local or regional economy, these facilities have been frequently demolished as facilities age or teams are sold, then relocated. One example is the KeyArena in Seattle, WA, which housed the NBA Seattle SuperSonics from 1967–78, 1985–94, and 1995–2008, but which continues to function in the interim periods without a team and still provides a venue for various forms of sports and entertainment today. 71 Across the United States, large shopping malls were the hubs of commerce, but many are vacant today. 72 Many shopping malls are considered CI by DHS, but has the disappearance of the physical retail infrastructure resulted in economic losses to the surrounding areas?

Also, theoretical scenarios involving the destruction of infrastructure facilities or systems should be explored based on the arguments presented within this article. If infrastructure systems have high levels of resilience and following disasters, areas are redeveloped in a more efficient and valuable manner, what would happen following a major cyber-attack that crippled the entire national power grid? While DHS and the Department of Energy work on strategies to harden the existing grid, 73 would a catastrophic failure result in the creation of a decentralized and sustainable energy infrastructure? The seemingly worst-case scenario of losing the existing power grid could eventually result in an improved energy delivery system, which would position the country for a stronger future. The worst circumstances may spur the greatest opportunity for positive change, which could shift homeland security strategies to focus primarily on effective recovery rather than on protecting existing systems.

Based on these findings, DHS should ensure that everything designated as “critical” meets the definition of criticality, the methodologies used for evaluating infrastructure align to the mission of protecting the nation from terrorism, and protection efforts account for the existing resiliency within the systems that provide essential-to-life infrastructure across the country. Many infrastructure facilities are inconsequential if attacked, and if the loss of a facility does not cause widespread disruptions, it is not CI. DHS should shift from an inclusive CI policy that allows facilities to self-designate and self-assess risks to a policy that assumes facilities are inconsequential to the security and functions of the nation unless proven otherwise.

A solution for accomplishing the task of effectively identifying, prioritizing, and protecting CI is to refine the criteria for how facilities are determined to be critical. A lower number of critical facilities will reduce the overall scope of the protection mission. Adopting a risk-based approach for both prioritization of facilities and evaluation of national impacts can assist DHS in more effectively designating facilities as “critical.”

About the Author

David Riedman is a Captain in the Montgomery County, MD Fire and Rescue Service and an expert in emergency and disaster preparedness, planning, and response. Mr. Riedman is a graduate of the Center for Homeland Defense and Security master’s degree program at the Naval Postgraduate School and received his undergraduate degree from Georgetown University. He is currently an associate at Obsidian, a Cadmus Company, and supports federal clients with strategic planning, policy development, and organizational improvement. He may be reached at [email protected]

The views expressed in this essay are those of the author alone.

1 “Statement by President George W. Bush in His Address to the Nation,” September 11, 2001, https://www.911memorial.org/sites/all/files/Statement%20by%20President%20Bush%20in%20His%20Address%20to%20the%20Nation.pdf .

2 “What is Critical Infrastructure?” August 26, 2015, http://www.dhs.gov/what-critical-infrastructure .

3 “Statement by President George W. Bush in His Address to the Nation,” September 11, 2001.

4 “Critical Infrastructure Sectors,” June 12, 2014, http://www.dhs.gov/critical-infrastructure-sectors .

5 The White House, Presidential Policy Directive—Critical Infrastructure Security and Resilience Presidential Policy Directive/PPD-21—Critical Infrastructure Security and Resilience (Washington, DC: The White House, 2013), http://www.whitehouse.gov/the-press-office/2013/02/12/presidential-policy-directive-critical-infrastructure-security-and-resil .

6 National Highway Transportation Safety Administration, Traffic Safety Facts 2013 Data (Washington, DC: U.S. Department of Transportation, 2015), http://www-nrd.nhtsa.dot.gov/Pubs/812181.pdf .

7 “Transportation Systems Sector,” March 25, 2013, http://www.dhs.gov/transportation-systems-sector .

8 Thomas Lueck, “Wall Street, No Longer Financial Epicenter, Struggles to Cling to Cachet,” The New York Times , December 26, 1994, http://www.nytimes.com/1994/12/27/nyregion/wall-street-no-longer-financial-epicenter-struggles-to-cling-to-cachet.html .

9 Peter Gosselin, “Wall Street Hits the Wall as Financial World Spins, Leading Firms to Depart the Nation’s Economic Capital,” The Boston Globe , June 28, 1996, http://www.highbeam.com/doc/1P2-8373110.html .

10 Alliance for Downtown New York, Inc., ADNY Annual Report 2014 (New York: Alliance for Downtown New York, Inc., 2014), http://www.downtownny.com/sites/default/files/Annual%20Report_2015_Final_Web2.pdf .

11 “About: LEED Certification,” accessed July 23, 2015, http://www.usgbc.org/leed .

12 “ADNY Annual Report 2014,” 2014, http://www.downtownny.com/sites/default/files/Annual%20Report_2015_Final_Web2.pdf .

14 Office of Tax Policy, Annual Report: New York City Property Tax FY 2014 (City of New York: Department of Finance, 2014), http://www1.nyc.gov/assets/finance/downloads/pdf/reports/reports-property-tax/nyc_property_fy14fmvandav.pdf .

15 Office of Tax Policy, Report on New York City Property Tax FY 2000 (City of New York: Department of Finance, 2000), http://www1.nyc.gov/assets/finance/downloads/pdf/99pdf/rptsum00.pdf .

16 “U.S. Inflation Calculator,” accessed July 23, 2015, http://www.usinflationcalculator.com .

17 Lueck, “Wall Street, No Longer Financial Epicenter, Struggles to Cling to Cachet.”

18 Office of Tax Policy, Report on New York City Property Tax FY 2000 (City of New York: Department of Finance, 2000), http://www1.nyc.gov/assets/finance/downloads/pdf/99pdf/rptsum00.pdf .

19 Mervyn Rothstein, “The Former Mobil Building, Largely Vacant in the 90’s, Gets a New Tenant, American Airlines,” The New York Times , October 29, 1996, http://www.nytimes.com/1996/10/30/business/former-mobil-building-largely-vacant-90-s-gets-new-tenant-american-airlines.html .

20 Charles Bagli, “Guardian Insurance’s Plan Adds to Downtown Rebirth,” The New York Times , January 8, 1998, http://www.nytimes.com/1998/01/09/nyregion/guardian-insurance-s-plan-adds-to-downtown-rebirth.html .

21 City of New York Independent Budget Office, Response to Request to Examine Critical Issues Underlying the Planned Rebuilding at the World Trade Center Site (City of New York: Independent Budget Office, 2006), http://www.ibo.nyc.ny.us/iboreports/stringerwtclet.pdf .

22 City of New York Independent Budget Office, Response to Request to Examine Critical Issues Underlying the Planned Rebuilding at the World Trade Center Site .

23 Alliance for Downtown New York, Inc., Lower Manhattan Real Estate Market Overview (New York: Alliance for Downtown, 2014), http://www.downtownny.com/sites/default/files/Q2%202014%20FINAL%20REPORT.pdf .

24 “World Trade Center,” July 9, 2015, http://www.newworldencyclopedia.org/entry/World_Trade_Center .

25 “Building Class Definitions,” accessed July 23, 2015 http://www.boma.org/research/Pages/building-class-definitions.aspx .

26 Jason Bram, James Orr, and Carol Raraport, “Measuring the Effects of the September 11 Attack on New York City,” FRBNY Economic Policy Review , November 1, 2002, https://www.newyorkfed.org/medialibrary/media/research/epr/02v08n2/0211rapapdf .

28 Appleseed, Economic Impact of Redeveloping The World Trade Center Site: New York City, New York State, And the New York—New Jersey Area (New York: Appleseed, 2003), http://www.renewnyc.org/content/pdfs/Appleseed.pdf .

31 New York City Department of Finance, Tentative Assessment Roll: Fiscal Year 2008 (New York: Department of Finance, 2007), http://www1.nyc.gov/assets/finance/downloads/pdf/07pdf/assessment_report_08.pdf .

32 Alliance for Downtown New York, Inc., Lower Manhattan Real Estate Market Overview 2014 (New York: Alliance for Downtown New York, Inc., 2014), http://www.downtownny.com/sites/default/files/Q2%202014%20FINAL%20REPORT.pdf .

33 Homeland Security Advisory Council, Report of the Critical Infrastructure Task Force (Washington, DC: Department of Homeland Security, 2006), 6, http://www.dhs.gov/xlibrary/assets/HSAC_CITF_Report_v2.pdf .

34 Alliance for Downtown New York, Inc., Lower Manhattan Real Estate Market Overview 2014 (New York: Alliance for Downtown New York, Inc., 2014), http://www.downtownny.com/sites/default/files/Q2%202014%20FINAL%20REPORT.pdf .

35  Ibid.

36 “The Business Case for Green Building,” accessed July 23, 2015, http://www.usgbc.org/articles/business-case-green-building .

37 From “One World Trade Center,” accessed July 23, 2015, http://www.wtc.com/about/buildings/1-world-trade-center .

38 Moteff, Copeland, and Fischer, Critical Infrastructures: What Makes an Infrastructure Critical? Congressional Research Service, 2003.

39 Urban Environmental Research, LLC, Clark County: Critical Infrastructure & Key Assets Final (Clark County, NV: Urban Environmental Research, LLC, 2008, http://www.clarkcountynv.gov/comprehensive-planning/regulated-business/Documents/Studies/CCCriticalInfrastructure0508.pdf .

40 The White House, Presidential Policy Directive—Critical Infrastructure Security and Resilience Presidential Policy Directive/PPD-21—Critical Infrastructure Security and Resilience .

41 From Brandon Griggs, “Fabled Las Vegas Casino Closes after 60 Years,” CNN , May 5 2015, http://www.cnn.com/2015/05/05/travel/riviera-hotel-casino-vegas-closes-feat/ .

42 Department of Homeland Security, Commercial Facilities Sector-Specific Plan an Annex to the National Infrastructure Protection Plan 2010 , 81.

43 Department of Homeland Security, Commercial Facilities Sector-Specific Plan an Annex to the National Infrastructure Protection Plan 2010 , 83.

45 “Yet Another Las Vegas Casino History Timeline,” accessed July 23, 2015 http://www.lvrevealed.com/deathwatch/las_vegas_timeline.html .

46 “Complete List of Las Vegas Casinos,” February 1, 2015, http://vegasclick.com/vegas/casinos .

47 From http://www.google.com/publicdata/explore?ds=kf7tgg1uo9ude_&ctype=l&strail=false&bcs=d&nselm=h&met_y=population&scale_y=lin&ind_y=false&reim=country&idim=place: 3240000:3260600:3231900&ifdim=country&tstart= 1104642000000&tend=1372737600000&hl=en&ind=false .

48 From “Las Vegas-Paradise Nevada Household Income,” accessed July 23, 2015, http://www.deptofnumbers.com/income/nevada/las-vegas/ .

49 From “Las Vegas-Paradise Nevada Rent and Rental Statistics,” accessed July 23, 2015, http://www.deptofnumbers.com/rent/nevada/las-vegas/ .

50 Brandon Griggs, “Fabled Las Vegas Casino Closes after 60 Years,” CNN , May 5, 2015, http://www.cnn.com/2015/05/05/travel/riviera-hotel-casino-vegas-closes-feat/ .

51 “Las Vegas-Paradise, NV Economy at a Glance,” July 21, 2015. http://www.bls.gov/eag/eag.nv_lasvegas_msa.htm .

52 “National Employment Monthly Update,” July 2, 2015, http://www.ncsl.org/research/labor-and-employment/national-employment-monthly-update.aspx .

53 From David G. Schwartz, Major Gaming Jurisdiction: Twelve-Year Comparison (Las Vegas: Center for Gaming Research, University Libraries, University of Nevada Las Vegas, 2013), http://gaming.unlv.edu/reports/12_year_comp.pdf .

54 From “Historical Las Vegas Visitor Statistics,” February 1, 2015, http://www.lvcva.com/stats-and-facts/ .

55 “NYC Statistics,” accessed July 23, 2015, http://www.nycgo.com/articles/nyc-statistics-page .

56 Department of Homeland Security, Water Sector-Specific Plan: An Annex to the National Infrastructure Protection Plan (Washington, DC: Department of Homeland Security, 2010), 13, https://www.dhs.gov/xlibrary/assets/nipp-ssp-water-2010.pdf .

57 Department of Homeland Security, Water Sector-Specific Plan: An Annex to the National Infrastructure Protection Plan , 13.

58 West Virginia Bureau for Public Health (WVBPH) and the Agency for Toxic Substances Disease Registry, Elk River Chemical Spill Health Effects Findings of Emergency Department Record Review April 2014 Collaborative Investigation by the West Virginia Bureau for Public Health (WVBPH) and the Agency for Toxic Substances Disease Registry (ATSDR) (West Virginia: Department of Health & Human Resources, 2014), http://www.dhhr.wv.gov/News/chemical-spill/Documents/ElkRiverMedicalRecordSummary.pdf .

59 Centers for Disease Control and Prevention, Disaster Response and Recovery Needs of Communities Affected by the Elk River Chemical Spill, West Virginia (Atlanta, GA: Centers for Disease Control and Prevention, 2014), http://www.dhhr.wv.gov/News/2014/Documents/WVCASPERReport.pdf .

60 Department of Homeland Security, Water Sector-Specific Plan: An Annex to the National Infrastructure Protection Plan , 25.

61 “Hoover Dam—Frequently Asked Questions,” March 12, 2015, http://www.usbr.gov/lc/hooverdam/faqs/damfaqs.html .

62 “Hoover Dam and Powerplant,” September 2013, http://www.usbr.gov/lc/region/pao/brochures/hoover.html .

63 “Hoover Dam—Frequently Asked Questions.”

64 Department of Homeland Security, Water Sector-Specific Plan: An Annex to the National Infrastructure Protection Plan (Washington, DC: Department of Homeland Security, 2010), https://www.dhs.gov/xlibrary/assets/nipp-ssp-water-2010.pdf .

65 “Hetch Hetchy Water System,” accessed July 23, 2015, http://bawsca.org/water-supply/hetch-hetchy-water-system/ .

66 Department of Homeland Security, Press Release: President Obama Signs Emergency Declaration for Michigan , January 16, 2016.

67 Ashley Southhall, “State of Emergency Declared Over Man-Made Water Disaster in Michigan City,” New York Times, January 17, 2016, http://www.nytimes.com/2016/01/18/us/obama-flint-michigan-water-fema-emergency-disaster.html?_r=0 .

68 Department of Homeland Security, Supplemental Tool: Executing a Critical Infrastructure Risk Management Approach .

69 “Rebuilding Stronger, Better, Greener!” accessed August 31, 2015, https://www.greensburgks.org /.

70 “I-35W St. Anthony Falls Bridge,” accessed August 31, 2015, http://www.dot.state.mn.us/i35wbridge/collapse.html .

71 “KeyArena History,” accessed August 31, 2015, http://www.keyarena.com/arena-information/keyarena-history .

72 Nelson D. Schwartz, “The Economics (and Nostalgia) of Dead Malls,” The New York Times , January 4, 2015, http://www.nytimes.com/2015/01/04/business/the-economics-and-nostalgia-of-dead-malls.html?_r=0.

73 “Trustworthy Cyber Infrastructure for the Power Grid,” accessed August 31, 2015, http://www.dhs.gov/science-and-technology/csd-tcipg .

Copyright © 2016 by the author(s). Homeland Security Affairs is an academic journal available free of charge to individuals and institutions. Because the purpose of this publication is the widest possible dissemination of knowledge, copies of this journal and the articles contained herein may be printed or downloaded and redistributed for personal, research or educational purposes free of charge and without permission. Any commercial use of Homeland Security Affairs or the articles published herein is expressly prohibited without the written consent of the copyright holder. The copyright of all articles published in Homeland Security Affairs rests with the author(s) of the article. Homeland Security Affairs is the online journal of the Naval Postgraduate School Center for Homeland Defense and Security (CHDS).

More Articles

What Comes Around, Goes Around (and Around and Around): Reviving the Lost History of FEMA and its Importance to Future Disasters

When Guns and Drugs are Democratized: Potential Technical Solutions to Counter the Negative Consequences of Three Dimensional Printing

Tiered Response Pyramid: A System-Wide Approach to Build Response Capability and Surge Capacity

Apples to Apples: RAMCAP and Emerging Threats to Lifeline Infrastructure

Leave a comment cancel reply.

Your email address will not be published. Required fields are marked *

An official website of the United States government

Here’s how you know

Official websites use .gov A .gov website belongs to an official government organization in the United States.

Secure .gov websites use HTTPS A lock ( Lock A locked padlock ) or https:// means you’ve safely connected to the .gov website. Share sensitive information only on official, secure websites.

Free Cyber Services #protect2024 Secure Our World Shields Up Report A Cyber Issue

A Plan to Protect Critical Infrastructure from 21st Century Threats

By Jen Easterly, Director, Cybersecurity and Infrastructure Security Agency

On April 30 th , the White House released  National Security Memorandum-22 (NSM) on Critical Infrastructure Security and Resilience , which updates national policy on how the U.S. government protects and secures critical infrastructure from cyber and all-hazard threats. NSM-22 recognizes the changed risk landscape over the past decade and leverages the enhanced authorities of federal departments and agencies to implement a new risk management cycle that prioritizes collaborating with partners to identify and mitigate sector, cross-sector, and nationally significant risk. The culmination of this cycle is the creation of the 2025 National Infrastructure Risk Management Plan (National Plan)—updating and replacing the  2013 National Infrastructure Protection Plan —and will guide federal efforts to secure and protect critical infrastructure over the coming years. 

As the National Coordinator for critical infrastructure security and resilience, the Cybersecurity and Infrastructure Security Agency (CISA) will develop this National Plan to be forward-looking and employ all available federal tools, resources, and authorities to manage and reduce national-level risks, including those cascading across critical infrastructure sectors. CISA will look to its partners to help us and the other Sector Risk Management Agencies (SRMAs) over the course of the year as we develop this foundational document. 

The National Plan Must Account for the Evolution of Threats, Vulnerabilities, and Consequences 

Building off the priorities of NSM-22, the 2025 National Plan will articulate how the U.S. government will collaborate with partners to identify and manage national risk. This will be an evolution from the 2013 National Plan which described risk management as “the cornerstone” to strengthening critical infrastructure security and resilience. Eleven years later, the spirit of this concept holds true; yet it must evolve due to pervasive vulnerabilities and an elevated threat landscape, which could lead to cascading regional and national consequences. Fortunately, over that same decade, Congress and successive administrations have established new agencies, authorities, and collaborative partnerships that empower a whole-of-society approach to national risk management. As the National Coordinator, CISA will be the primary driver for operationalizing this approach through the National Plan. 

The National Plan will be Informed by a New Risk Management Cycle

NSM-22 details a new risk management cycle that requires SRMAs to identify, assess, and prioritize risk within their respective sectors and develop sector risk management plans to address those risks. With these risk assessments and risk management plans, CISA will identify and prioritize systemic, cross-sector, and nationally significant risk through a cross-sector risk assessment. This assessment will enable CISA to prioritize systemic risk reduction efforts—detailed in the National Plan—that the U.S. government will take in collaboration with relevant federal, state and local, private, and international partners. Most importantly, the National Plan will recognize that the U.S. government cannot make all critical infrastructure immune from all threats and hazards. Rather, it will detail U.S. government efforts to make critical infrastructure resilient against prioritized risks based on the 16 sector’s risk assessments and CISA’s cross-sector risk assessments. All the while, CISA and other federal partners will work closely with SRMAs to manage their unique sector risks.  

We Need You for Us to be Successful 

This will be a fundamentally new approach to U.S. government risk management. In this era of technological advancements and dynamic global volatility, the security and resilience of our critical infrastructure are of paramount importance. Essential systems, including energy grids, water systems, transportation networks, healthcare facilities, and communication systems, are vital for public safety, economic stability, and national security. The increasing interconnectivity of critical infrastructure systems, reliance upon global technologies and supply chains, and geopolitical tensions make these systems susceptible to a myriad of threats. Addressing these risks will require a coordinated national effort by federal agencies; State, Local, Tribal, and Territorial (SLTT) governments, infrastructure owners and operators, and other stakeholders across the critical infrastructure community. 

As those responsible for the security and resilience of U.S. critical infrastructure, we must collectively address emergent risks and an uncertain future while remaining vigilant against longstanding threats like terrorism, natural disasters, and targeted violence. Indeed, trusted, sustained, and effective partnerships between the federal government and private-sector and SLTT partners is the foundation of our collective effort to protect the nation’s critical infrastructure. 

Put simply, the 2025 National Plan will not succeed unless our partners collaborate with us to inform its development and its eventual implementation. We ask that you work with your respective SRMAs through the development of your sector risk assessments and sector risk management plans, as these will be core inputs into the National Plan. You can also contact us at  [email protected] for any of your ideas. These inputs will be invaluable as we develop a plan that allows the U.S. government to better prioritize our risk mitigation efforts and reduce risk for the critical infrastructure that underpin American society. 

For more information on the NSM-22 and CISA’s role as National Coordinator, visit CISA National Security Memorandum on Critical Infrastructure Security and Resilience | CISA .

Related Articles

Learn with region 8’s webinar program, looking ahead to better prepare today, honoring our unsung heroes – celebrating public service recognition week, under the digital radar: defending against people’s republic of china’s nation-state cyber threats to america’s small businesses.