Sabotage is not the main threat to critical infrastructure in Canada
Canadian critical infrastructure is vulnerable because it is dispersed
Human threats to critical infrastructure in Canada are “latent” rather than real.
EDITOR’S NOTE: In December, 2011, The Macdonald-Laurier Institute published study by Andrew Graham, from Queen’s University, called Canada’s Critical Infrastructure: When is Safe Enough Safe Enough?, which outlined the security risks to Canada’s critical infrastructure. The following essay, the fourth of five, was written by Barry Cooper, a political science professor at the University of Calgary.
Troy Media – by Barry Cooper
Geopolitics underlies the problems of safety in Canadian Critical Infrastructure (CI) and conditions any plausible response to them.
First, by far the greatest threats are natural disasters, especially floods, storms, and, at least in the Lower Mainland of BC, earthquakes. Human threats are “latent” rather than real.
Second, most Canadian CI is in private hands – 85 per cent by one estimate. As a result, the focus of the owners of Canadian CI is more on accidental damage, aging physical plants, and vandalism than it is on terrorism and catastrophic failure.
Suspicious of government
For example, the most likely threat to Canadian energy pipelines comes from digging at construction sites, not sabotage. Due to widespread private ownership, there is an understandable reluctance to share information with governments that do not place the same value on proprietary information as do its owners.
As a result of the importance of energy-related CI, and the way, for example, pipelines are monitored, namely by remote computerized sensing and control systems, the real human threat (such as it is) may better be understood in terms of cyber attacks than shifting landforms or kinetic attack. In other words, cyber threats can be seen as “meta-threats,” that is, both a direct and an indirect threat. This is a point to which we will return below.
Canadian CI is vulnerable because it is dispersed and its vulnerability matters because CI is important. But vulnerability does not necessarily mean our CI is at risk, but only that it might be.
In order to be at risk, CI must be threatened and the threats must be assessed in terms of credibility or probability as well as severity of the potential for damage. A clear understanding of the trade-offs between low-impact and high-probability events (such as pipeline rupture) and low-probability, high-impact ones (such as cascading electrical failures) is necessary in order to allocate our limited threat-prevention and threat-mitigation resources. Such allocations invariably involve political decisions pressured by regionally competitive interests and the unavoidable question of federalism and shared jurisdictions.
A problem that renders the questions of limited resources and federalism even more difficult is that the seemingly commonsensical question “Are we safe enough?” is not appropriate, chiefly because it cannot be answered. A risk-free society is not possible because risk is inherent in the human capacity to act; the attempt to create a risk-free society is not desirable because the cost in hard cash is infinite.
Moreover, the effort to create such a political order is self-destructive because it invariably extinguishes individual liberty. Accordingly, the problem of vulnerability needs to be rearticulated in terms of resiliency, not complete protection or security. As a consequence, the role of government, especially the Government of Canada, is necessarily more limited than Ottawa bureaucrats typically allow.
Specifically, the reliance of the Government of Canada on what they call “all hazard (or all threat) risk analysis” needs to be reconsidered in light of: (1) the limited jurisdiction of the Government of Canada, and (2) the limited capacity of any government to deliver “security.” As Andrew Graham pointed out in his report, such an approach is defensive and so reactive rather than proactive, state-centric when the state is in many respects peripheral, and complex beyond the capacity of even the cleverest bureaucrat to comprehend. Such a strategy ensures defeat because its goals are impossible to achieve.
As a consequence, most state activity, especially by the Government of Canada, is nothing but planning to plan. This is a bureaucratic nightmare because Public Safety Canada must attempt to coordinate its activities with 14 other departments and agencies, which is a recipe for the kind of disaster that the American Federal Emergency Management Agency experienced in its response to Hurricane Katrina.
In short, non-recognition of reality with respect to security, which we may choose to label “federal leadership,” is likely to mean the issuing of ineffective and largely harmless rules by remote bureaucrats, not effective political responsibility.
So long as Canadian CI is widely distributed and so long as Canada is governed as a federation, it is useful to think of distribution of CI and responsibility for its protection as two sides of the same coin. Indeed, diffused CI can be seen as a strength because it makes coordinated attacks more difficult and because diffuse responsibility, besides reflecting the constitutional order of the federation, allows local authorities to exercise their proper responsibilities. Moreover, the existing links between privately owned CI and local police and other first-responders means that the fantasy of centralized coordination (or rather, duplication of existing protocols) by Public Safety Canada must be abandoned.
Cyber crime is different
There is one area where the Government of Canada might play an effective role -possibly by restoring the RCMP Commercial Crime Unit to an elite formation within the organization in the area of cyber threats and cyber crime. Cyber threats are inherently novel and changing, chiefly because they rely on innovative and emergent technologies, from social media and botnets to cloud computing and constant connectivity. The Pentagon established Cyber Command as a subordinate command to Strategic Command in 2009 precisely to deal with military threats from cyber space. In early 2011, a Chinese-based cyber attack on Treasury Board and the Departments of Finance and National Defence indicated that it would be prudent to follow the American example.
Moreover, as noted above, any threat to energy CI is better conceptualized as a cyber threat to management of operations than as a direct or kinetic threat to disrupt them. If there are to be any useful initiatives by the Government of Canada besides the churning out of ever more elegant plans, cyber threats would be a good place to start.
Barry Cooper is a political science professor at the University of Calgary.
Category: Canada
Subscribe
If you enjoyed this article, subscribe to receive more just like it.
