18 Bridging the Vulnerability Paradigm to Critical Infrastructure …
343
18.6 Bridging the Vulnerability Paradigm and CI Processes
to Improve Resilience
18.6.1 “Critical” for Whom? The Need to Redefine Critical
Infrastructure Boundaries Based on Service Access
Definition of “critical” implies in judgment quality of importance. However, distinction between the internal criticality, such as the supply and distribution goods and
services, and external criticality, such as functionality, user accessibility, and dependence, are not thoroughly developed in CI literature (Zio 2017). There is a general
assumption that understanding the internal criticality of the infrastructure, such as the
supply of fuel for example, is the same as understanding the external criticality of the
infrastructure, such as the demand of fuel for specific functions such as emergency
services. The criticality judgment is often done based on definitions from governmental guidelines on CI, but has rarely presented empirical evidence of criticality to
users in terms of its functional importance to society.
Steele et al. (2017) call for less authoritative policy statements on CIs in the
Australian government framework for CI. The authors criticize that current definition of what represents “critical” infrastructure is not taking into consideration key
linkages between cyber-physical structures and human and environmental system
integrity and equity. The official definition of criticality has shown little concern for
the service-effectiveness (as opposed to cost-efficiency and cost effectiveness) of
CI’s role to ensure functionality in what is critical to people’s lives and livelihoods
at a non-national scale. Most CIs are owned by private corporations and operated
through a complex system of public-private partnerships. In this context, variation
of ownership in terms of public and private organization as well as dispersed and
heterogeneous ownership within the private and public sectors, makes the allocation
of risk and responsibility difficult to discern, especially in the context of climate
change, and projected hazards that have yet to occur. This difficulty in allocating risk
management responsibilities often results in a major gap between the preoccupation
of the risk to the infrastructure itself and the risk to communities or organizations
from loss or disruption of goods and services. In the case of certain CIs that carry
hazardous materials, as does the TES, their disruption not only represent a threat to
communities because of service interruption but also because of hazardous material
release. This results in a coupled threat namely natural-hazard-triggered technological disaster (Natech) that is rarely investigated in CI processes (Cruz and Krausmann
2013; Krausmann et al. 2017), and would be key information for integrating external
criticality and societal impacts of CI disruption.
In the context of CI that functions as supply chain systems, as mentioned above,
supply chain risk literature demonstrates that over 82% of publications do not explicit
any definition of risk, where 9% of those that do explicit, define risk as the probability
of an adverse outcome (Heckmann et al. 2015). This means that most publications
343
18.6 Bridging the Vulnerability Paradigm and CI Processes
to Improve Resilience
18.6.1 “Critical” for Whom? The Need to Redefine Critical
Infrastructure Boundaries Based on Service Access
Definition of “critical” implies in judgment quality of importance. However, distinction between the internal criticality, such as the supply and distribution goods and
services, and external criticality, such as functionality, user accessibility, and dependence, are not thoroughly developed in CI literature (Zio 2017). There is a general
assumption that understanding the internal criticality of the infrastructure, such as the
supply of fuel for example, is the same as understanding the external criticality of the
infrastructure, such as the demand of fuel for specific functions such as emergency
services. The criticality judgment is often done based on definitions from governmental guidelines on CI, but has rarely presented empirical evidence of criticality to
users in terms of its functional importance to society.
Steele et al. (2017) call for less authoritative policy statements on CIs in the
Australian government framework for CI. The authors criticize that current definition of what represents “critical” infrastructure is not taking into consideration key
linkages between cyber-physical structures and human and environmental system
integrity and equity. The official definition of criticality has shown little concern for
the service-effectiveness (as opposed to cost-efficiency and cost effectiveness) of
CI’s role to ensure functionality in what is critical to people’s lives and livelihoods
at a non-national scale. Most CIs are owned by private corporations and operated
through a complex system of public-private partnerships. In this context, variation
of ownership in terms of public and private organization as well as dispersed and
heterogeneous ownership within the private and public sectors, makes the allocation
of risk and responsibility difficult to discern, especially in the context of climate
change, and projected hazards that have yet to occur. This difficulty in allocating risk
management responsibilities often results in a major gap between the preoccupation
of the risk to the infrastructure itself and the risk to communities or organizations
from loss or disruption of goods and services. In the case of certain CIs that carry
hazardous materials, as does the TES, their disruption not only represent a threat to
communities because of service interruption but also because of hazardous material
release. This results in a coupled threat namely natural-hazard-triggered technological disaster (Natech) that is rarely investigated in CI processes (Cruz and Krausmann
2013; Krausmann et al. 2017), and would be key information for integrating external
criticality and societal impacts of CI disruption.
In the context of CI that functions as supply chain systems, as mentioned above,
supply chain risk literature demonstrates that over 82% of publications do not explicit
any definition of risk, where 9% of those that do explicit, define risk as the probability
of an adverse outcome (Heckmann et al. 2015). This means that most publications