Antonio Tejeda Encinas, President of the Euro-American Committee of Digital Law - CEA Digital Law
Most of us who live in the Western world have enjoyed the enormous privilege of being able to take the functioning of critical infrastructure for granted. Clean water, reliable roads, high-quality healthcare, electricity, and dependable telephone and email services are all so fundamental to modern life that it is impossible to imagine living without them.
The advent of the internet has made critical infrastructure more complex, more interdependent and therefore more fragile. We have grown complacent in our reliance on critical infrastructure, but recent developments have been a rude awakening. It is now clear that cyber warfare can have an impact on the physical world through attacks on critical infrastructure. The often poorly understood interdependencies between critical infrastructure sectors pose a serious risk. A blow to one sector could trigger cascading second-order effects in others, leading to a large-scale catastrophe that spirals out of control.
Cyberattacks on critical infrastructure
Critical infrastructure consists of the systems regarded as fundamental to the functioning of a society and an economy, such as energy, transport, telecommunications, food and water supply, and vital health services. The disruption or destruction of critical infrastructure would have an immediate and direct impact on economic activity, daily life and the safety of those affected.
Advances in cyber weapons and hacking toolkits now allow malicious actors to attack critical infrastructure in ways that have an immediate and frightening effect on the physical world. In 2015, Ukraine was hit by a shocking cyberattack that succeeded in disabling part of the country’s power grid. The attack, believed to have been carried out by Russia, deliberately caused widespread blackouts affecting hundreds of thousands of people. Although that attack and similar incidents targeting Ukraine in the years that followed caused only temporary disruption, they provide ample evidence of the scale of damage that cyberattacks could inflict on critical infrastructure. During the attack, hospitals had to go back to pen and paper.
Digital technology has made the world smaller, and critical infrastructure in Western nations is not safe from this new danger. The US government has accused Russia of infiltrating the country’s power grid and gaining remote access to energy sector computer networks (US Department of Homeland Security 2018). In 2017, the WannaCry ransomware epidemic crippled Britain’s National Health Service for several days, leading to the cancellation of 19,000 appointments. In Denmark, the headquarters of Maersk, which handles around a fifth of the world’s shipping, was paralysed by the NotPetya malware, causing disruption at port facilities around the world.
As a result of these events, cyberattacks on critical infrastructure have become a pre-eminent national security concern.
What makes the possible consequences of a major cyberattack on critical infrastructure so hard to predict is the interdependence between sectors. An attack on one sector could have knock-on effects on the other sectors that depend on it. The transport sector relies on the energy sector for the electricity that powers trains and traffic control systems, just as the energy sector depends on the transport sector for the timely delivery of fuel and other inputs. On the threat of remote infiltration, a working group of industry experts and government officials at MIT’s Internet Policy Research Initiative warned that no one currently understands the extent to which electricity generation is coupled with other sectors, and that the risk of catastrophic macroeconomic failure in the event of a cyberattack is therefore not adequately understood. A proper understanding of the interdependence between critical infrastructure sectors is vital if the inherent risks are to be fully appreciated.
Boletim
Eventos, notícias e análises sobre direito digital, no seu e-mail. Só quando houver novidades.
