It’s not just the collapse of a critical resource that can wreak havoc. Rather, it’s the inherent interdependencies within these systems — the potential for a domino effect of failures — coupled with the complex nature of public and private interests inherent in critical infrastructure.
To understand how critical infrastructure drives unique challenges for emergency managers, it helps to start with a real-world example.
On April 9, 2009, vandals in San Jose, Calif., cut through an AT&T fiber-optic cable, disrupting land line and cellphone service to thousands of residential and business customers, but the damage went much further. The Internet went down, 911 calls were stymied and law enforcement telecommunications broke down.
“If the police made a car stop, they couldn’t ask for warrants, they couldn’t run license checks, so it became an officer safety issue,” said Frances Edwards, the former director of emergency preparedness for San Jose. The incident proved vividly that a breach in the private infrastructure could have broad implications, even hampering public-sector efforts to manage an emergency.
The San Jose outage is but one example, and not even the most extreme, of the perils posed by a vulnerable infrastructure.
In September 2010, a 54-year-old gas pipeline exploded in San Bruno, Calif., killing eight people and destroying more than 50 homes. In one high-profile incident in 2007, a bridge spanning the Mississippi River in Minneapolis collapsed, killing 13 and injuring 145.
Events like these illustrate why the American Society of Civil Engineers (ASCE) gave America an overall “D” grade for its decaying critical infrastructure.
The situation appears to be a recipe for disaster. The average bridge in the U.S. is 43 years old, and one in four of the nation’s 600,000 bridges is deficient, according to the ASCE. The Wall Street Journal reported that of more than 3,000 oil and gas production platforms operating in the Gulf of Mexico, one-third were built in the 1970s or earlier. It gets worse: A New York Times analysis found that a significant water line bursts roughly every two minutes, or 720 times a day.
Complicating the situation for emergency planners is the fact that every event related to critical infrastructure is unique, leaving planners to face more unknowns than knowns.
Each time an infrastructure element fails, “it causes the emergency managers to reconsider all of their emergency plans,” Edwards said. “You don’t know what you don’t know, so after you have an event like this, it makes you stop and wonder: What else is out there? Now you have all this new information on how systems actually function, so you have to rethink your procedures and retrain your staff to make room for the new reality based on what you did not know before.”
In other words: a moving target.
The situation is further compounded by the privatization of roughly 85 percent of the nation’s most critical infrastructure systems. That infrastructure may encompass varied forms. According to the U.S. DHS, critical infrastructure includes not just the obvious — roads, bridges, power grids, nuclear facilities and dams — but also agriculture, health care, manufacturing and other categories.
In contemplating this extremely wide range of possible sources of calamity, emergency managers must work through a delicate dance with private owners of infrastructure.
In this dance, even simple definitions can be confusing.
If a substantial power outage is cause for emergency action, “how do the local government and the utility agree on the definition of ‘substantial?’ How many customers are out? What will the utility be reporting to emergency management, and what will be the emergency manager’s expectation of that?” said Charlie Fisher, vice president of crisis management consulting firm Witt Associates.
Chain of command likewise may not translate easily between public and private players. As the two work to craft an emergency plan, who will the private sector send to the table? “Is this someone who has knowledge and authority, or just a messenger?” Fisher said. “If you are sitting with the police chief and the fire chief, you want a very senior person from the utility there as well.”
In fairness, some say the burden of planning should fall on the public managers, not because it’s their designated role but because any failure in the infrastructure system will likely come from the public side.
While there may be infrastructure weaknesses all around, the private sector has a financial interest in ensuring its critical components are sound. At the same time, the public sector is notoriously underfunded and behind on its upgrades in many jurisdictions. This combination weights the scale toward a crisis coming from the public side, said Annie Searle, principal of risk assessment consultancy Annie Searle & Associates.
“The pieces on the private-sector side are in really good shape — they’ve maintained them,” Searle said. “We’re worried about the public infrastructure where the dollars may not have gone into either maintenance or improvement of the infrastructure.”
Still, it’s not an easy equation. With so many vital systems in private hands, the two sides must cooperate. This means overcoming jurisdictional vagaries, said Wendy Freitag, external affairs manager of the Washington State Military Department’s Emergency Management Division.
“They control access to it, and the government draws a line and respects that ownership,” Freitag said. This has practical implications. Take the scenario in which hurricane debris lands on private property. Government responders won’t move on that. Now suppose that private property is a reservoir, whose compromise might contaminate the water system. Jurisdictional concerns may keep responders at arm’s length.
And then there’s the money. As Freitag noted, the Stafford Act would prevent public servants from claiming federal reimbursement, should they go for a cleanup on private property. In laying plans for such an event, emergency managers must think carefully about financial ramifications.
Overall, cooperation is the key to success in dealing with public-private tensions, Freitag said. The best thing emergency planners can do is to look to the private sector as customers: Develop a sound relationship by listening to what your customers need. “Typically their priority is in having access. They want to get in, repair and restore what needs to be restored. You have to listen to that. You have to care about what they need.”
Joint training helps establish rapport. In Washington, all state certification and training classes are open to the private sector. Beyond this, communication is the final pillar. Freitag’s office uses proprietary software Public Information Emergency Response (PIER), which allows outreach to more than 400 private- and public-sector members. “The key to maintaining a private-public partnership is having some sort of a two-way communication tool,” she said.
Responding to a critical infrastructure disaster is not just a two-way street — public to private. It’s an every-way street. It’s in the nature of critical systems to be enmeshed and intertwined with a whole host of other systems and processes. A burst dam causes a flood, which takes down power, which kills the phones. Meanwhile roads wash away. The ripple effect can be staggering to emergency responders.
The Idaho Bureau of Homeland Security is ever mindful of this fact. Ever since a cataclysmic dam failure in 1976, the state has held a heightened sense of watchfulness concerning its 632 dams.
Dams are owned either by private entities, the Corps of Engineers or the Bureau of Reclamation. The owners have the primary responsibility for drawing up response plans, while the Bureau of Homeland Security follows up with training and exercises, explained bureau spokesman Robert Feeley. By their nature, those plans are far-reaching.
“There are cascading effects to any event, and that is one of the challenges of emergency management, to identify all those effects,” Feeley said. Planning begins with geography, the mapping of an inundation area likely to be hit by a dam breach. This in turn gives rise to an analysis of the power grid in each affected area. The flood maps also determine jurisdiction: Imperiled roads, for instance, are handed off to the county sheriff’s office. Evacuation plans meanwhile fall into the hands of first responder communities.
Often an emergency manager’s knowledge of interdependencies will be critical to the organization of an emergency response. Fisher described a scenario in which a hurricane took out communications to the local electric company. Both pieces needed to be brought back on line, but only one thing mattered: restoring power and communications to the EOC. Without that first step having been built into the emergency plan, no other element of response could have been carried out effectively.
The San Jose blackout described above — the result of vandalism — serves as a stark reminder that the failure of critical infrastructure need not necessarily be caused by acts of nature, or even by slapdash maintenance and restoration.
Critical infrastructure is thought by many to be a natural target of terrorists seeking to inflict harm or cause panic among a broad population. In fact, any of the 18 sectors designated as “critical” by the DHS could be vulnerable to a terrorist attack.
For public safety planners, the emergency services sector will seem especially notable. An attack there can render first responders unable to meet other concurrent challenges. For example, jurisdictions with nuclear reactors, chemical plans and dams could well be subject to coordinated attacks that first render their emergency responders unavailable, prior to a larger-scale attack.
Density also can factor into the terror equation. The U.S. Army Training and Doctrine Command offers a range of statistics showing how a heavy concentration of resources can render a sector vulnerable. Nearly a third of U.S. hog inventories are in Iowa. Some 25 percent of all pharmaceuticals are manufactured in Puerto Rico. More than half of the banking sector is focused on lower Manhattan. The densities make for appealing targets.
For emergency planners, crafting a response around sectors with a high terrorism risk can be especially challenging, because of the confidential nature of many of these facilities. Take for, instance, the Idaho National Laboratory, a nuclear research institution. Although representatives of the lab have a seat at the table in the state’s EOC, they don’t always offer full transparency. This still is a facility that trades in highly secret information.
It’s a tricky balance, crafting a plan without seeing the full picture. “There are things we are going to know about and things we are not going to know about,” Feeley said. His office’s response is to do the best it can within the constraints. “Working from the generalities, we can develop action plans for what could happen, without having to know exactly what they are doing in this facility.”
Given the inherent limitation, the best solution has been to keep doors open. Feeley’s office reaches out to the nuclear side and administrators typically reciprocate. Representatives from the lab recently presented Feeley’s office with a briefing on lab activities.
“We appreciated that. It gave us a very good picture of what is going on there.”
The threat of terror sometimes leaves emergency managers struggling to balance the need for security against their duty to craft plans that address public safety most efficiently. They may need to risk some exposure to a terror event in the name of meaningful emergency response. That’s a fine line to walk.
Given the interdependencies and the possible ripple effect of a breach, planning for an infrastructure event demands a rigorous and well thought-out process.
One such process comes from King County, Wash., where emergency planners have broken down their approach to infrastructure into a virtual road map of response.
The plan identifies, up front, the role owners and operators play in critical infrastructure protection decision-making. Owners must help with the assessment of vulnerabilities, assess their own dependencies on other infrastructure sectors and identify ways in which government agencies can help protect their critical infrastructures.
The plan then lays out detailed risk-management processes, assigns specific roles and responsibilities, describes the procedure for sharing information and establishes a protocol for making decisions.
Planners then designate a hierarchy of concern: from energy, IT and telecom to government facilities and banking institutions, to icons, monuments and commercial facilities.
To make it possible to draw up an effective plan, the county drills down into the details of just what constitutes risk. How vulnerable is the infrastructure? What are the likely threats and their consequences? How likely is a breach? The county plan lays out precise definitions for assessing each area.
The county designates lead players, including the Regional Homeland Security Council, Critical Infrastructure Protection Work Group, local, federal and state governments, and others.
Taken together, the county’s definitions, procedures and protocols help to generate emergency plans that respond with considerable precision to the varied threats faced by critical infrastructure.
The great distinction in an infrastructure disaster always comes down to the question of interdependency, the cascade effect in which one system failure causes similar crashes down the line.
It’s a consideration that emergency planners must always keep foremost and yet there’s no simple formula to help them make those complex calculations.
“What we need now is a super-simple, easy model to use where we can map these interdependencies and see them very visually,” Freitag said.
Such a model would need to have a high degree of sophistication and would draw from multiple public and private sources. Given the complexities of the task, she said, “I think government is going to have to be the one to develop that. It’s something everybody needs.”
