What's in a Name? Changing Critical National Infrastructure

Those sharp-eyed spotters among us who carefully monitor the output of Government websites might perhaps have felt the right to be bemused when confronted with the changing definition of critical national infrastructure (CNI) that has recently emerged. The services we, as a society, receive (or not!) have not altered one iota as a result of the new definition. How we experience or pay for our utilities, transport, Government or indeed telephone systems has not radically altered from December 2006 to June 2007, yet how it is categorised has changed dramatically. Perhaps it merely represents a new ‘broom’ or fresh start with which to welcome in the new security advice agency for critical infrastructure, the Centre for the Protection of National Infrastructure (CPNI) created on 1 February 2007, a banner of diligence or industriousness with which to greet (and perhaps justify) the new organisation: ‘Look! Aren’t we useful and busy?! We’ve redefined the very thing that confers our existence!’ But we would be wrong to dismiss this change of definition as mere window-dressing or an exercise in ‘bureaucratese’: it is a highly significant national security strategy move.

In metaphorical terms, critical national infrastructure can be thought of as the ‘lifeblood and backbone’ of the country (a phrase adopted during RUSI’s recent conference on ‘Securing Critical National Infrastructure’);[1] but this is not particularly helpful to a policy maker, security practitioner or potential CNI owner no matter how closely it gets to the philosophical essence of what is being discussed. Back in December 2006, when the CPNI was only another structural reorganisation headache for the Government’s army of change managers, CNI was served from a security perspective by two bodies – NSAC and NISCC – whose security responsibilities were delineated through regard to personnel and physical for the former, and IT for the latter. At this time the definition of CNI was found on the MI5 website and was described thus:

‘The Government views the CNI as those assets, services and systems that support the economic, political and social life of the UK whose importance is such that any entire or partial loss or compromise could:

cause large scale loss of life; have a serious impact on the national economy; have other grave social consequences for the community, or any substantial part of the community; or be of immediate concern to the national Government.

The Government considers that there are ten ‘sectors’ of economic, political and social activity in which there are critical elements. They are:

communications; emergency services; energy; finance; food; government & public service; public safety; health; transport; water.

Not every activity within these sectors is critical, but application of the criteria outlined above assists Government and managers within each sector to identify where best to concentrate protective security effort.’[2]

On the CPNI’s inception, the definition of CNI was altered. The most obvious casualty was the taxonomy of CNI which changed from ten sectors to nine sectors. The sector that lost out in the new definition was ‘public safety’. Whilst this may seem a heinous omission, the logic of CNI suggests that public safety resides elsewhere. On the one hand it is swept up in the other sectors, such as emergency services, Government & public service or health, which remain within the CNI taxonomy. On the other hand, public safety can be conceived of as an overarching concept which informs security and resilience efforts across the public sector; it cannot usefully be reduced to a sector within CNI. Either way this sectoral change is not the most important or interesting amendment that took place in the CNI reformation, as important as public safety undoubtedly is.[3] By way of introducing the most significant change it is worth reproducing the new CNI definition as it appears on the CPNI website:

‘The Government places a high value on ensuring that the UK is well protected against attacks by terrorists or other national security threats.

The national infrastructure is the underlying framework of facilities, systems, sites and networks necessary for the functioning of the country and the delivery of the essential services which we rely on in every aspect of our daily life. Examples of essential services include the supply of water, energy and food. Failure of this infrastructure and loss of the services it delivers could include severe economic or social damage and/or large scale loss of life.

There are nine sectors which deliver essential services: energy, food, water, transport, telecommunications, Government & public services, emergency services, health and finance. Within these sectors there are key elements that comprise the critical national infrastructure. These are the components or assets without which the essential services cannot be delivered. These components may be physical or electronic.

CPNI works with the operators of essential services and with lead Government departments to identify critical national infrastructure within the nine sectors, and to help protect it against national security threats. Sufficient protection should be in place at all times.’[4]

The key change that has happened with the definition is to place CNI security within the context of the essential services for which it is responsible. In this way CNI in itself is not as important as what it actually delivers, which is a subtle but important difference.[5] And it is most important because, by stressing CNI’s relationship with essential services, it recognizes and reconciles the understanding of CNI with the Government’s broader framework of capability work-streams – the overarching mechanism for delivering UK Resilience –[6] and in particular the essential services works-stream. As the Government’s resilience website proclaims, ‘(T)he aim of the Capabilities Programme is to ensure that a robust infrastructure of response is in place to deal rapidly, effectively and flexibly with the consequences of civil devastation and widespread disaster inflicted as a result of conventional or non-conventional disruptive activity.’[7] The essential services workstream is divided into five, comprising health services, food and water, financial services, transport, and utilities, with a nominated Lead Government Department responsible for ensuring plans exist to maintain services and supplies in the event of a catastrophic incident. The Civil Contingencies Secretariat retains the directing and coordinating role to ensure delivery of the Capabilities Programme.

The catastrophic incidents to which the capabilities programme refers includes the threat of terrorism alongside natural disaster, because it is recognised that response often requires ‘a similar capability…’[8] This organic conception of resilience resonates also with the reforming idea of security articulated in the CNI definition which transcends the dominating focus of terrorism to acknowledge non-specific ‘other national security threats.’[9] Another manifestation of this phenomenon is the creation of the Office for Security and Counter-terrorism which will provide the strategic and coordinating end-to-end delivery of the Government’s counter-terrorism (CONTEST) strategy but with acknowledgement of its application in the wider security sphere. The (re)definition of CNI in terms of the essential services it delivers, reflects a fundamental re-orientation towards a coherent, integrated and strategic approach to security and resilience that is taking place across Government.

Of course when redefining CNI we may all have our own opinion of what is critical to the nation. There is undoubtedly an argument that can and is made for the inclusion of assets and icons within notions of national criticality particularly if we introduce an idea of the effect on national psyche or cohesion. Such instances may be exemplified by the death of Diana, Princess of Wales, the future security of the Olympics in 2012, or national landmarks. Indeed there may well be a temporal dimension to criticality. But whilst these ongoing debates are an important barometer of society’s changing needs and expectations and display a quality which perhaps suggests a critical nature, they do not fit with the model that argues critical national infrastructure is that ‘stuff’ which ensures the provision of essential services – a return to the ‘backbone and lifeblood’ analogy. Not only does the CPNI’s redefined conception provide clarity of understanding, it also ensures clarity of purpose across the Government agencies and private sector organisations that operate and manage this space.

The apparently simple process of redefining CNI may not appear groundbreaking in itself, but it is recognition of engagement and strategic thinking across the public sector reflecting the Government’s evolving confrontation with security. As the Home Secretary stated in April 2007, ‘(I)t is also essential that security is addressed within the context of the challenges of the twenty-first century.’[10] In this way ‘breaking-up’ may be hard to do, but in so doing the machinery of Government changes will provide the foundation for ‘joining-up’ security strategy. The evolutionary journey of the CNI definition is testament to this ‘joining-up’ process, and the efforts to enhance the UK’s security and resilience.

Critical infrastructure protection is a current area of study in RUSI. For more information on this strand of research please contact Neile@rusi.org.

Neil Ellis
June 2007

NOTES

[1] See RUSI Analysis

[2]  www.mi5.gov.uk/output/page76.html (Accessed January 2007)

[3] Indeed, outside of considerations of CNI, there is a pressing need to examine the understanding, position and management of ‘public safety’ in modern societies.

[4]  www.cpni.gov.uk/About/whatIs.aspx (Accessed June 2007)

[5] It is also important to acknowledge that caution should be employed when trying to talk about CNI as a cohesive entity, a ‘thing’.

[6]  ‘Capability’ is a military term which includes both personnel, equipment and training and such matters as plans, doctrine and the concept of operations. 'Resilience' is defined as the ability to detect, prevent and if necessary handle disruptive challenges.” UK Resilience (Accessed June 2007)

[7] Ibid.

[8] Ibid.

[9] www.cpni.gov.uk/About/whatIs.aspx (Accessed June 2007)

[10] John Reid, “Securing the Critical National Infrastructure”, RUSI Journal, June 2007, Vol. 152, No. 3, P14

The view expressed here do not necessarily reflect those of RUSI