Saturday, October 22, 2016

US Elections System as Critical Infrastructure?

What is "Critical Infrastructure?"

According to the US Department of Homeland Security "Critical Infrastructure" includes those assets, systems, and networks whether physical or virtual, that are considered so vital to the United States that their incapacitation or destruction would have a debilitating effect on security, national economic security, national public health or safety, or any combination thereof.

Presidential Policy Directive-21 (PPD-21), "Critical Infrastructure Security and Resilience," identifies 16 critical infrastructure sectors.  These sectors include:

  • Chemical Sector
  • Commercial Facilities Sector
  • Communications Sector
  • Critical Manufacturing Sector
  • Dams Sector
  • Defense Industrial Base
  • Emergency Services Sector
  • Energy Sector
  • Financial Services Sector
  • Food and Agriculture Sector
  • Government Facilities Sector
  • Healthcare and Public Health Sector
  • Information Technology Sector
  • Nuclear Reactors, Materials, and Waste Sector
  • Transportation Sector, and 
  • Water and Wastewater Sector

What About the US Elections System/Sector?

In the news these past six weeks there has been an elevated discussion regarding the US election system and whether or not it should be identified as "Critical Infrastructure" and thus protected in the same way and means as the other 16 identified infrastructures.  This is aggravated by Mr. Trump questioning the integrity of the US election system and elevated concerns raised by the media that our country's enemies may take action to negatively impact the results of the voting on Tuesday, November 8th.

In early August, Secretary of the Department of Homeland Security, Jeh Johnson, observed:

"There's a vital national interest in our election process, so I do think we need to consider whether it should be considered by my department and others as critical infrastructure."  However ... 
 "There's no one federal election system. There are some 9,000 jurisdictions involved in the election process," Johnson said. (Link)

So, Johnson's perception is that there is no single "Election Infrastructure Sector" per se and it may be challenging to quickly and effectively identify it as "Critical Infrastructure."

I even heard of this issue at a recent conference held by the North American Electric Reliability Corporation (NERC) where a "new" critical infrastructure sector could be the US election system.

With some investigation by this writer, an article published on September 13, 2016, in Fedscoop, was located noting DHS Assistant Secretary for Cybersecurity, Andy Ozment, said that DHS will not classify election systems as critical infrastructure before the November 2016 presidential election.

Ozment's quote continued:

"This is not something we're looking to in the near future.  This is a conversation we're having in the long term with state and local government, who are responsible for voting infrastructure.  We're focused right now on what we can usefully offer that local and state government will find valuable.

"From our perspective, it gives us more ability to help.  It does not put DHS in charge."

It will be fascinating to see how this conversation progresses -- especially if Mr. Trump's noisy questioning of the integrity of the voting process continues through and after the presidential election.

At a minimum, perhaps the "Election System Sector" could be included under the auspices of the "Government Sector" Critical Infrastructure designation rather than adding "Number 17."


Tuesday, October 18, 2016

Review - WEF Global Competitiveness Report

This September 2016 the World Economic Forum (WEF) published its annual Global Competitiveness Report 2016-17.  This report is almost 400 pages of a fairly comprehensive analysis of each country in the world and its relative competitiveness based on 12 separate factors (shown below):

And based on these 12 factors, the factors themselves are broken down into key elements for:

  • Factor-Driven Economies
  • Efficiency-Driven Economies, and
  • Innovation-Driven Economies
For instance Institutions and Infrastructure are key "Basic" requirements necessary for an economy to thrive and compete.

The WEF analysis then used these factors to ascertain the competitiveness of a country relative to the rest of the world as well as to its geographic region in many cases.  For instance, the top 10 most competitive countries using this methodology are:

And the bottom 10 are:

Infrastructure Factor

The elements reviewed to calculate each factor are listed in the "Technical Notes and Sources" section at the end of the report.  Since this blog is focused on infrastructure there is interest on the elements included in this calculation.  These include the following:

  • Quality of overall infrastructure
  • Quality of roads
  • Quality of railroad infrastructure
  • Quality of port infrastructure
  • Quality of air transport infrastructure
  • Available airline seat kilometers
  • Quality of electricity supply
  • Mobile-cellular telephone subscriptions
  • Fixed telephone lines
At first glance, this list is missing such elements as fresh/potable water supply, food availability and distribution, etc.  However, the "Technological Readiness" factors include the following that could be considered part of the strength of a country's infrastructure:

  • Availability of latest technologies
  • Firm-level technology absorption
  • Foreign Direct Investment and technology transfer
  • Internet users
  • Fixed broadband Internet users
  • Internet bandwidth
  • Mobile broadband subscriptions


As usual, the quality and content of this report are very good.  It is compelling and interesting and a useful reference for country policy development.


Friday, July 29, 2016


In early July the U.S. Department of Homeland Security (DHS)/Office of Cyber and Infrastructure Analysis (OCIA) published an analysis entitled Impact of Population Shifts on Critical Infrastructure.  The report is a very compelling and interesting read and gives you a sense of how hard it is to augment infrastructure when the population is increasing (such as in the areas where fracking is in progress) and, how difficult it is to maintain current infrastructure when your tax base -- i.e., population -- is leaving as in the Rust Belt of the US.

To give the reader a sense of those areas in the continental US where population increase and decline may contribute to stresses on installation and maintenance of critical infrastructure is shown in a map shown below:

The map does reflect population shifts from the Northeast and Midwest to the South and West -- especially Texas, Georgia and Arizona/Nevada. According to the report, the new growth is in part because of high-technology magnet areas in the West and South, energy development of shale gas and shale oil in rural areas throughout the country, and regrowth in cities in the South and West with housing-led reversals. This growth is also partially because of lower costs of living, potentially including lower tax rates.

Rapidly increasing populations result in:

  • Increased demand for services
  • Increased infrastructure use
  • Increased rural roadway use requiring expensive reconstruction and repair
  • Reduced available downtime for infrastructure maintenance and repairs
  • Challenges in funding immediately needed infrastructure upgrades since available money may be delayed due to tax and revenue stream deferrals to later years.
  • Increased frequency and severity of disruptions to water and wastewater systems
Reduced populations result in:
  • Reduced tax base resulting in funding shortfalls for infrastructure maintenance and repairs
  • Uneven population densities within metro areas


The report does offer some approaches to address bot increasing and declining populations and the impacts on critical infrastructure.  The key recommendations for both cases are:
  1. Strategic Planning -- For rapidly increasing population growth, strategic planning is critical for meeting increases in demand -- especially because of the lead-time needed for financing; designing and planning projects; obtaining regulatory approvals; siting and constructing the infrastructure.
  2. Public-Private Partnerships -- These partnerships and their collective approach can be useful for infrastructure planning/development/maintenance during times of population growth or decline.  Don't forget, most of the critical infrastructure in the US is privately owned.  And because these private entities rely on state/local government approval to deploy large infrastructure projects their partnership and cooperation is critical.

Thursday, June 23, 2016


My full-time job is that of a security consultant, but I am also a hobbyist student of geopolitics.  My favorite (or is that favourite) publication in this regard is The Economist published weekly.  Unfortunately due to my consulting work along with other personal and professional obligations I often don't have the opportunity to really "read" the magazine from cover-to-cover.  But, rather than place the magazine on my notorious "to be read" stack, I have established a technique I'd like to share on how I can take some quality time to glean the contents of the magazine and at least add quickly to my geopolitical knowledge.
When I receive the magazine the first section I turn to is Contents.  Here I read the different titles of the articles but I'm especially sure to read the side-boxes (see below) since they offer a good sense of the themes covered in this week's issue.
Figure 1 - Read the Boxes
This is the most interesting and most effective part of my time with The Economist.  On these three pages, I get to view and digest the weekly cartoon and then get a good flavor of the world's news that I certainly don't obtain from the US television or newspapers.  For instance, in this week's issue, there is news from Nigeria, Kenya, Ethiopia, Bahrain, Indonesia, Bangladesh besides the "normal" news sources of the US political scene, China, Paris and of course the UK.
PHASE III: LEADERS (~ Pages 13-17)
This part of the magazine is my favorite.  Here you can gain a sense of the pros/cons, plusses/minuses of the issues raised by the editors of the magazine.  I especially like the coverage of these editorial comments since they cover most of the world and, again, are not focused on the US.  Yes, there are comments on US politics (e.g., the 2016 election, Orlando, etc.) but the other editorial coverage is in areas that I am not familiar or often exposed.  
Finally, during my 15 minutes of quality time with the magazine, I'll skim through the different sections usually pausing on some of the editorials, reviewing any graphics/maps, and speeding through the different text boxes.
Of course, if I'm ready to get on a plane or have some added time then I'll be sure to read the magazine in more depth but my focal points will generally begin with my four phases above.
If you don't already subscribe to The EconomistI'd highly recommend you do.  You'll find that the view offered is so much more superior than US television and is more portable than my other favorite reads The New York Times or Washington Post.

Monday, May 23, 2016

Earthquake Risk and US Highway Infrastructure

Thanks to our friends at the Federation of American Scientists (FAS) a recent Congressional Research Service report entitled Earthquake Risk and U.S. Highway Infrastructure: Frequently Asked Questions was posted.  This 11-page report is an excellent overview of the current state of natural and man-made (read - "Fracking") earthquake impact on the US highway system.

Two figures in the report are very telling as to the concentration of earthquakes and implications on "Shaking expected for Tall Structures Like Bridges" (below)...

as well as a graphic showing the chance of human-induced and natural earthquakes.  (Look at the concentration around Oklahoma presumably due to Fracking.)

Key Comments in the Report

The report approaches these issues in a FAQ, here are some quick highlights:

Q:  What Are the Components of Seismic Risk?

A:  Seismic risk to a highway system is determined by three factors:

  • Likelihood of seismic events of varying magnitudes, and related physical events, often referred to as the hazard;
  • Vulnerability of highway structures to damage from such events; and
  • Potential consequences of that vulnerability (e.g., lives lost, economic disruption, etc.)
Q: How Vulnerable Is the U.S. Highway System?

A:  "No national database exists on the seismic design and retrofit status of highway system components; thus, a perspective on vulnerability at the national level is unavailable.  However, many states with large seismic hazards have compiled data on the vulnerability of highway components within their borders..."

Q:  How Vulnerable are Highway Bridges?

A: Basically many of the most vulnerable older bridges -- particularly in the West Coast States -- have been retrofitted to improve seismic resilience; however, many older bridges (around 13,000) in the New Madrid seismic zone (AR, IL, IN, KY, MO, MS, TN) have not been retrofitted.

Q: How Costly is Retrofitting Highway Infrastructure?

A:  Because no national data exist on the status of retrofitting existing highway bridges or other infrastructure (e.g.,tunnels, highway systems), no national estimates exist.  


If you are involved in transportation policy or a student of infrastructure, this is a useful starting point to give you a sense of the daunting task of improving the resilience of highway structures against earthquakes.

Thursday, May 19, 2016

"The Business of Hacking" -- Recommended Reading for CEOs, Boards of Directors, Governance Leadership

What is your view of the "hacking community?"  Is it one of masked computer operators working in a darkened room or that of a white-coated laboratory technician?  Well, your views of the hackers working on new products and "services" to steal your information may be substantially changed after your read the most recent document from Hewlett Packard Enterprise entitled The Business of Hacking:  Business Innovation Meets the Business of Hacking.  
This document is an easy and compelling read for Chief Executive Officers, Chief Information Officers, Boards of Directors, Risk Analysts and cyber security students.  The article does an excellent job giving a straight-forward discussion regarding the "reality" of the cybercrime community and their "business models."

The HP whitepaper does a nice job clearly identifying "who" the "Bad Guys" are with a simple chart (shown below):

This is extremely helpful to those trying to understand cybercrime and cyber "hacking" because it shows there are different types of hackers with different motivations and capabilities.

The article almost reads like a Gartner report with a "Magic Quadrant" depiction of where the attackers are working relative to Payout and Effort/Risk to their "business."  The quadrant analysis is shown below:

Although the report doesn't go into details on how organized cyber crime is used by Nation-States, analysis has shown that some countries may be using organized cyber crime to do their cyber attacks thus giving the Nation-State the ability to offer "plausible deniability."

Finally, this report will reinforce to the CEO's, et al that the cyber crime business is just that...a business...where the hackers want to maximize profit and minimize risk...where the hackers need to do research and development and they need to have a finance minister to run their economic shop.

On a parenthetical note, in 2006 I wrote Chapter 1A, "Cybercrime's Impact on Information Security,"  in Cybercrime & Security edited by Pauline C. Reich.  In my article I discussed cybercrime as a business -- albeit nefarious - but with a CEO, COO, HR manager, VP of R&D, CFO, etc. and that their motives are focused on "....profit maximization and risk management..."

Key Take-Aways

This white paper from HP is a great educational piece to get to your Board of Directors, CEO, COO, CFO, CIO and cyber security students who need to realize that one way to hamper cyber crime is to alter the criminal's business operations .... raise their expenses and increase their risk.


Thursday, April 14, 2016

WEBINAR: Climate-Resilient Infrastructure -- 28 April 2016


I've been rather swamped with a major project for the past few months so my Blog has been pretty quiet.  Anyway, I want to pass along this one Webinar my fellow infrastructure colleagues may be interested.




This FREE webinar will feature a panel of experts on infrastructure planning and climate change discussing new approaches to planning climate-resilient infrastructure.  The topics to be covered include:

  • How climate change affects infrastructure
  • How planners can respond to climate change by planning integrated and resilient infrastructure
  • Principles for re-thinking how we invest in infrastructure
  • How US Federal Agencies are adapting this approach to their grants and disaster relief programs, including information on the Federal Emergency Management Agency (FEMA) National Resilience Challenge and the US Housing and Urban Development (HUD) Disaster Resilience Competition
Ms. Jill Sterrett, FAICP, Affiliate Instructor,  Department of Urban Design and Planning, University of Washington, Seattle, WA  USA

Mr. Rhys Roth, Faculty and Director of the Center for Sustainable Infrastructure, Evergreen State College, Olympia, WA USA

Mr. Steve Moddemeyer, Principal, CollinsWoerman Architects, Seattle, WA USA