US Critical Infrastructure: Cybersecurity, Finance & Transport

Introduction: Defining Critical Infrastructure

Infrastructure is effectively what makes a nation run. It encompasses the people, places, and things necessary to deliver critical services and goods. The US Department of Homeland Security often abbreviates critical infrastructure as CIKR (Critical Infrastructure and Key Resources) and defines it as consisting of "the assets of the United States essential to the nation's security, public health and safety, economic vitality, and way of life," including "power grids and water filtration plants; national monuments and government facilities; telecommunications and transportation systems; chemical facilities" (CIKR, 2009, par. 1). Although the majority of CIKR is privately owned, the government still has a vital protective role to ensure it functions correctly.

Although the Internet was still in a relatively primitive stage when DHS was first established, the online element of the nation's critical infrastructure cannot be underestimated and has grown seismically in importance. People entrust a tremendous amount of vital data to make payments and conduct transactions in private enterprise. As Chertoff and Grant (2017, par. 1) observe, "We are in an era where there is no such thing as a 'secure' password; even the most complex password is still a 'shared secret' that the application and the user both need to know." The government has also entrusted a tremendous amount of vital data online, and more and more information is stored in the so-called cloud rather than in physical computer hardware. This makes information more accessible, but also easier to access illicitly, steal, and manipulate if hackers have the right tools and knowledge.

Cybersecurity Threats to the Nation's Digital Infrastructure

Tapping into or disrupting the nation's cyber infrastructure can bring commerce and government to a standstill, as well as potentially yield a source of revenue for terrorists, hackers, and common criminals in the form of stolen information. When people's Internet services are disrupted or their identity is compromised, this is also tremendously damaging to their sense of personal security, given the extent to which jobs as well as daily routines are dependent upon the Internet.

Tied into threats to infrastructure broadly, the relative security of the nation's financial services is likewise critical. The financial disruption caused in the wake of the 2008 crash had a chilling impact on both investment and employment. Again, technology infrastructure plays a significant role in governing the evolution of this sector. Automated programmed trading has made financial volatility a daily reality, and "lightning-fast trading models, automated sell orders and an arsenal of sophisticated algorithms" have caused crashes and spikes in the market regardless of whether there is concrete and verifiable external economic reason for them (Harwell, 2018, par. 2). While the 2008 crash has largely been attributed to a lack of transparency regarding financial instruments and insufficient regulation of the financial and banking industry, automated trading makes it even easier for outside rogue agents to manipulate markets, as well as for firms with experience using creative financial instruments to profit at the expense of smaller investors engaged in sensible, long-term investment strategies.

As Tal (2018, par. 4) notes, "Quite often, physical and cyber protection services are also outsourced, making optimized defense more complicated and creating more opportunities for leaked defense-related knowledge, procedures and data, and contributing to shortages of highly skilled personnel." This outsourcing dynamic compounds the difficulties of securing financial infrastructure against both external and internal threats.