The IRGC White paper (report) focus on five infrastructures (electric power, natural gas, rail, urban water systems, and a variety of ICT systems) because they are considered as critical to the successful functioning of Western industrialised societies. The report provides brief summary of policy framework and review historical of development of each infrastructure (mainly EU ans US). By performed evaluation of major blackouts/ accidents, the report identifies infrastructure-characteristic patterns, critical elements and vulnerabilities.
The report introduces a template (matrix) which can be used for an initial assessment of critical infrastructures and their dependencies. The matrix estimates and cross-compares (from an Western societal perspective) the degree of criticality using factors such as the scope of the geographical area affected, the agnitude of impact or losses and the effects of time of a service interruption or degradation. The matrix may provide initial guidance on where to put emphasis on risk governance strategies and how to tailor in the report outlined measures. According to the report, the results may differ for another societal context, or from an individual perspective.
The IRGC White paper analysed critical infrastructures as follows (only general lines):
Electrical power is important for many social and economic activities and services as well as for the functioning of other vital infrastructures. “The degree of criticality is high as the impact of a failure, loss or unavailability is high in scope (potentially international), magnitude (major) and effects of time (immediate)”. Power supply systems have been developed in the past 50 years and “[…] the way in which these systems are now operated is often beyond the original design parameters, mainly due to market liberalization”, and “a minor single event (e.g. a line overload or a tree flashover due to inadequate tree-cutting) may snowball into massive problems for a highly burdened electrical power system with long transmission distances”. The IRGC team (among others) concluded that “political aims in the EU are too strongly focussed on costs, and that systemic risks and new security issues have not received adequate attention” and provide suggestions for strategies (“[…] strategies must include demand management and priority setting; equipment reliability and planned steps to reduce restoration times; technologies such as micro-grids and back-up systems to reduce dependence on the grid”).
Interruption of gas supply can have major impacts has a strong impact on the economy of a country and the well-being of society as well as on other infrastructures, especially through the disruption of electricity supply. “The degree of criticality may be quite high in scope and magnitude at a local or national level, but in most cases moderate to weak on a more global level. Widespread availability of storage leaves the system less vulnerable than electric power, but supply constraints such as those resulting on the US Gulf Coast after Hurricanes Katrina and Rita can have major impacts on availability and price.” “As a result of its large spatial extent and because many critical elements of the system are above ground, the gas transmission system is exposed to numerous hazards and vulnerable to potential attacks. Nevertheless, due to the design and physical properties of the system it is robust and safe.”
“The degree of criticality is moderate, as impacts of failures, losses and unavailabilities will in most cases be limited in scope (local to regional), magnitude (minimal to moderate) and effects of time. The rail transport infrastructure depends on other infrastructures, in particular energy supply and ICT systems to different degrees, whilst the energy sector may depend on fuel transported by rail and the ICT systems may use data transmission lines that are often routed along rail rights-of-way.” “Trains are parked in open-access areas. They also stop in, or pass through, crowded and sensitive areas such as stations, hazardous facilities and protected areas. They must therefore be regarded as highly attractive targets for terrorist attacks […]”.
“The scope of loss of water supply is generally local or regional, but health-related risks can increase significantly with the duration of the interruption and be perceived as more serious than physical events or the loss of energy supply. On the other hand, the intentional or inadvertent introduction of some contaminants can have major consequences for public health.” Water supply and wastewater management systems are “highly sensitive to environmental impacts such as, for example, pollution of the source water in the aftermath of natural disasters or through sewage treatment overflow during heavy rain conditions. The consequences of such events often do not occur immediately and allow timely countermeasures, such as the activation of emergency response plans.” Water infrastructure can be endangered in two main forms: contamination from biological or chemical agents or disruption of processing and distribution. The most common accidental cause of contamination in distribution systems is a cross-connection to the wastewater system. Failures of wastewater treatment systems can lead to wastewater overflows into the environment, which result in public health issues. In addition - contamination cannot be detected visually, therefore humans feel very vulnerable to a possible attack. Among other, adequate water supply influence most fire department capabilities. The report indentifies following interdependency: “interruptions of the electric power supply can endanger water and sewage systems by, for example, putting pumping stations and water treatment plants out of commission. Failure of the road or rail transportation system may limit the supply of treatment chemicals. Furthermore, water systems rely heavily on the IT infrastructure for monitoring and control, particularly to regulate pressure”.
Many organisations (major exceptions - electricity supply) rely on the Internet and on computer networks for daily operations (within own organisation and in collaboration with partners, suppliers and customers). These operations include on-site and remote data management. This makes it rather difficult to separate the information and communication sector from all other sectors, including other critical infrastructures. The report is grouping threats to the Internet into two categories - threats against the Internet infrastructure and threats using the Internet as a platform or vector.