In times of growing cyber threats and severe weather, resilience – the ability to continue providing emergency services while damaged infrastructure is restored – has emerged as a growing concern among leaders at state and local levels. The world is held together with strands far more fragile than most people realize, said Kelly Wilson, Senior Critical Infrastructure analyst for Idaho National Laboratory.
“The capabilities aren’t what people think they are,” said Wilson, who came to INL this year from the U.S. Department of Homeland Security. Many states are running critical infrastructure programs at a bare-bones level.
For years, INL and DHS have led the national effort to address strategic planning issues in matters of safeguarding critical infrastructure such as factories, power plants, water treatment facilities and communications systems. INL has been leading resilience symposia since 2008, expanding it to Resilience Week in 2013. The latest, in San Antonio, took place the first week of November.
The lab also recently established the INL Resilience Optimization Center (IROC) to leverage multidisciplinary capabilities across lab facilities to address complex infrastructure resilience challenges.
Now, the state of Idaho stands to benefit from all that expertise in its backyard. Building on the relationship with its home state, INL is developing an Idaho Infrastructure Guidebook, expected to be completed in 2020. It will offer details on infrastructure critical to community lifelines and the state’s economy.
Threats to infrastructure, both natural and of human origin, can be short-term or long-term, but the vulnerabilities are widespread and one infrastructure disaster can cascade into another.
The guidebook will examine Idaho’s supply chains to address critical questions: What does Idaho rely on from outside the state to enable its most critical food and agriculture infrastructure? What could cause a disruption to these supply chains?
Another section will look at natural and human-caused hazards, their frequency and consequences, as well as their likelihood of increasing or decreasing in the future. Last of all, information in each section will offer a picture of the current and future state of infrastructure and how it may affect plans to bring major industries to Idaho.
“There’s a strong correlation between economic development and resiliency,” Wilson said. The guidebook will offer an economic profile of the state’s most important or largest industries and employers and examine the economic drivers — micro and macro — that could change the state’s economic profile for better or worse.
There is no one-size-fits-all approach to resiliency. National resilience requires asset owners, especially of lifeline systems, to be deliberate about the resilience of the infrastructure within their direct control. They also must be conscious of their dependence upon infrastructure out of their direct control. Resilience planning should be scaled and bound to an asset owner’s finite resources (time, budget and staffing), its risk profile and critical operations.
In addition to its DHS ties, INL has deep and long-standing experience with the U.S. departments of Defense and Transportation. In the private sector, the lab has worked with companies critical to the United States energy sector and with public power utilities that possess fossil fuel, nuclear, hydro-electric and renewable assets.
Both the government and private sector have a shared responsibility to prevent and reduce the risks of disruptions to critical infrastructure.
The vast majority of critical infrastructure in the United States is privately owned and operated. Whether it’s the energy that lights our homes and drives commerce, the water we drink and use to irrigate crops, the transportation systems that move us and our goods, or the communication networks that connect us all, critical infrastructure provides the essential services that underpin our society.
Managing the risks associated with these systems requires an integrated approach among public and private partners to identify threats and hazards, reduce vulnerabilities, and mitigate the potential consequences.
A U.S. Army veteran and former Maryland state trooper, in 2012, Wilson became a Protective Security Advisor for DHS’s Cybersecurity and Infrastructure Security Agency, first in Washington, D.C., then in San Diego.
While at DHS, she took part in the Regional Resiliency Assessment Program (RRAP), a nonregulatory assessment program aimed at addressing hazards that can have significant consequences, both regionally and nationally. RRAPs can incorporate various components, including voluntary facility vulnerability assessments, targeted studies and modeling, first responder capability evaluations, subject matter expert workshops, and other valuable information-exchange forums.
Wilson has been coordinating the guidebook project with the Idaho Office of Emergency Management and its director, Brad Richy. “I think it should give us an opportunity to look at what we have and where we can build resilience,” he said. Flooding, wildfires and earthquakes are nothing new in the state, but resilience is getting more attention.
At a retreat in November 2018, in partnership with the National Governors Association Center for Best Practices (NGA Center), Idaho officials participated in a two-day forum focused on policies and strategies to improve disaster resilience planning. Among the presenters, INL offered an assessment of cyber interdependencies, indicating that only 5% of critical infrastructure owners/operators have physical security, cybersecurity and business continuity plans that they use for training or annual exercises.
Richy said Idaho has had a long-standing relationship with INL that has offered advantages on many fronts. “To have a national laboratory in your backyard is an amazing opportunity,” he said. “Their capabilities are extraordinary. They definitely make good neighbors, wherever you are.”
In Idaho, where agriculture and food play a major role in the economy, Wilson’s focus has been on a “Wired Farmer“ resiliency study proposal, dealing with precision agriculture and its reliance on lifeline infrastructure, particularly communications and information technology systems. Along with the Idaho guidebook and the GIS guide, the Wired Farmer study will be a resource for planning outreach and research, while helping analysts keep track of assets ranging from dams to data centers.
“The infrastructure footprint is changing all the time, including dependencies between assets and associated consequences of disruption,” Wilson said.
In both the public and private sectors, true resiliency requires commitment from everyone. In her experience, Wilson said, she has found more than a few infrastructure owners and operators unwilling to share information with the government “until they are in trouble.”
“Where is it? Who owns it? What is the capacity?” she said. The irony is, because of the internet, “The information is already out there in the world.” But the response to any emergency can be mounted much faster if the information is integrated and a plan has been put together.
