Protecting Critical
Infrastructure

By Bruce Don and David Mussington

Bruce Don is the RAND Study Director for the Office of Homeland Security's physical protection planning team. David Mussington is a RAND policy analyst.

One of the defining tasks of the Office of Homeland Security is to develop a truly national strategy for homeland security. To be effective, the strategy must include plans to prevent attacks, protect critical infrastructure, and ensure prompt recovery after an attack. This essay pertains to the second requirement: protecting critical infrastructure around the country.

Critical infrastructure refers to transportation and energy systems, defense installations, banking and financial assets, water supplies, chemical plants, food and agricultural resources, police and fire departments, hospitals and public health systems, government offices, and national symbols. In other words, critical infrastructure refers to those assets, systems, and functions so vital to the nation that their disruption or destruction would have a debilitating effect on our national security, economy, governance, public health and safety, and morale.

The potential weaknesses in our critical infrastructure are numerous and complex because of the size and interconnectivity of our infrastructures. Below is a sampling of the kinds of problems that could hit closest to home for many Americans:

  • There is no public national effort to enhance the security of future energy system configurations, including the electric power grid and other interdependent power generation and distribution facilities, nor do industry experts believe that the private energy sector is planning adequately for these potential configurations.

  • No close relationship exists between the agricultural sector and the intelligence community. The lack of close contacts between these two groups means that information about possible attacks on the food supply does not currently flow to the appropriate public agency.

  • The public health system is unprepared for its role as first responder in the event of biological, chemical, or radiological attack. Weaknesses include an absence of stable funding for public hospitals and clinics around the country; incompatible communications links with emergency, law enforcement, and federal agencies; shortages of skilled personnel; and possible shortages of supplies and medical equipment.

  • Computer control centers are potentially lucrative targets for attack. Three sectors of infrastructure that may be particularly vulnerable to control-center attacks are oil pipelines, air transportation systems, and railroads, because the associated computer control systems are concentrated in a small number of critical nodes or facilities. This concentration makes large segments of the infrastructure potentially vulnerable to disruption from a small number of destructive incidents.

Below are several examples of the kinds of candidate solutions now being analyzed by RAND for the Office of Homeland Security. These candidates are drawn from workshops conducted by a RAND study team with nearly 500 experts in security, emergency response, law enforcement, and infrastructure management:

  • Collaborate with state and industry leaders to protect the electric power grid and other power generation and distribution facilities.

  • Reduce the vulnerability of oil refineries to terrorist attacks. Such attacks could be launched from the ground or the air. In either case, comprehensive vulnerability assessments and defense planning should be undertaken to avoid potentially catastrophic losses in service.

  • Require tightened security and access procedures for food production. Meanwhile, develop plans for communicating to the public about food safety. Coordination is needed between industry and government during food security threats. While industry must control access to food production, the government should take the responsibility for maintaining public confidence in the food supply. Plans should include communications about food security risks, threats, incidents, and appropriate public responses.

  • Launch an initiative to provide first responders in the agricultural and public health sectors with improved capabilities of surveillance, detection, and verification of biological or chemical hazards. State and local regulatory agencies, as well as farmers, need access to improved technological and communications tools to help secure the food supply.

  • Accelerate the examination of the public health infrastructure for its readiness to combat biological or chemical terrorism. Federal support should be targeted to training public health professionals to prevent and respond to terrorist attacks. Data repositories at local public health centers should also be enhanced to improve their potential utility during emergencies. It is clear that additional financial resources will be necessary if the public health system is to expand its responsibilities to include homeland security duties.

  • Expand the training of first responders, with an emphasis on the unique hazards associated with the chemical industry. Training medical personnel to deal with chemical contamination should also be a high priority. An initiative to expand local and state capabilities, and also to increase collaboration with the chemical industry, should be launched in the near term.

  • Develop emergency communications systems that link critical infrastructures to law enforcement and homeland security agencies. These communications systems would allow public agencies to retain connectivity with one another during periods when normal civil communications links are disrupted.

  • Deploy information and security systems to guard the locks on the Mississippi and St. Lawrence seaways. These systems will allow for the monitoring of vessels and ships while in locks or approaching locks. River marshals could be deployed to accompany dangerous shipments through the locks.

  • Develop a list of trusted and nontrusted shippers. Such a list would allow for trusted shippers to operate with few restrictions while the maritime infrastructure was on a heightened state of alert. Ports would need to develop different layouts—isolating trusted shippers and their shipping containers from others—for efficient inspections of freight traffic.

  • Establish a national transportation identification system. The U.S. Department of Transportation should create a single system for travelers and operators. All private, state, and federal authorities would duly recognize the credentials issued by the system. Current efforts in this area would benefit from enhanced legislative attention.

  • Organize the domestic homeland security effort around regionally based antiterrorism response centers. The regional centers could house training and outreach activities; foster routine information sharing among federal, state, and local agencies; and conduct outreach to the private sector.

In the long run, the process of developing and refining the national strategy to protect our critical infrastructure should be based on a continuous planning system among federal, state, and local governments as well as with the private sector. In addition, applying computational techniques and models to the process of prioritizing infrastructure vulnerabilities will improve resource allocation and enable better analysis of interdependencies among critical systems. A rigorous planning system should define the goals, analyze the costs and effects of proposed solutions, measure progress toward the goals, and adapt the solutions and investments as necessary based on measured feedback.

Contents