Quantitative evaluation of the synergistic effects of failures in a critical infrastructure system

www.elsevier.com/locate/ijcip Available online at www.sciencedirect.com Quantitative evaluation of the synergistic effects of failures in a critical infrastructure system David Rehak a, n , Jiri Markuci a , Martin Hromada b , Karla Barcova a a Faculty of Safety Engineering, VSB –Technical University of Ostrava, Lumírova 13, 70030 Ostrava-Vyskovice, Czech Republic b Faculty of Applied Informatics, Tomas Bata University in Zlín, Nad Stráněmi 4511, 76005 Zlín, Czech Republic article info Article history: Received 25 June 2014 Received in revised form 18 November 2015 Accepted 18 May 2016 Available online 18 June 2016 Keywords: Critical infrastructure Czech Republic Linkages Dependencies Impacts Synergistic effects abstract A critical infrastructure is a complicated system whose failure (in whole or in part) has a significant impact on national interests, including security, the economy and basic human needs. The system consists of relevant sectors, elements and their mutual linkages. In order to study critical infrastructures, it is necessary to apply a systems approach based on cross-sectoral evaluation and research into the linkages between the individual critical infrastructure sectors. Specifically, it is necessary to describe the individual vertical and horizontal levels of each critical infrastructure and the associated linkages. From this point-of-view, a critical infrastructure is embedded within the broader context of emergencies and enterprises, representing a compact and mutually-interconnected system. This paper focuses on quantitatively assessing the impacts of critical infrastructure failures. It presents a theory of synergistic linkages, their levels and the synergistic effects due to the joint action of impacts, which increase the overall impact on the critical infrastructure and on society. The concepts are formalized in the SYNEFIA methodology, which is applied in a case study involving the critical infrastructure of the Czech Republic. In particular, the methodology is applied to determine the synergistic effects of disruptions to multiple sub-sectors of the Czech infrastructure. &2016 The Authors. Published by Elsevier B.V. This is an open access article under the CC BY-NC-ND license (http://creativecommons.org/licenses/by-nc-nd/4.0/). 1. Introduction Advanced societies require infrastructures [4] for their smooth functioning as well as to enhance general welfare and continued development. The purpose of critical infrastructures is to effectively and rapidly distribute energy, commodities and services to recipients (i.e., society) through its sectors, elements and linkages [3]. However, infrastructures all over the world are constantly being threatened by a broad spectrum of interacting anthropogenic and natural dangers [32]. An activated threat can cause a failure of a component or function of an infrastructure. Admittedly, such an event is not very likely, but its impact could be enormous [17]. The level of unacceptable impacts depends on the http://dx.doi.org/10.1016/j.ijcip.2016.06.002 1874-5482/&2016 The Authors. Published by Elsevier B.V. This is an open access article under the CC BY-NC-ND license (http://creativecommons.org/licenses/by-nc-nd/4.0/). n Corresponding author. E-mail address: [email protected] (D. Rehak). international journal of critical infrastructure protection 14 (2016) 3–17 severity of the failure, its cause (i.e., character of the threat) and the criticality of the affected elements or sectors. Such impacts are often expressed in terms of economic losses, number of people affected, size of the affected region and other factors that fall into three basic categories: (i) critical proportion; (ii) critical time; and (iii) critical quality [11]. When the threshold values of the impacts (i.e., sectoral and crosscutting criteria) are exceeded, the corresponding infrastructure sectors and their elements are deemed to be critical; taken together, they constitute the critical infrastructure [10]. The importance of critical infrastructure protection was first highlighted by the United States in 1995. Over the years, critical infrastructure protection activities were initiated by other countries –Canada in 1998 and the United Kingdom, Sweden and Switzerland in 1999. Since the infamous attacks of September 11, 2001, many European countries have defined their critical infrastructure assets and launched critical infrastructure protection efforts. In the National Infrastructure Protection Plan of 2013 [31], the U.S. Department of Homeland Security defined the critical infrastructure as “systems and assets, whether physical or virtual, so vital to the United States that the incapacity or destruction of such systems and assets would have a debilitating impact on security, national economic security, national public health or safety, or any combination of those matters.”The Australian Government [1] defines critical infrastructure as “those physical facilities, supply chains, information technologies and communication networks which, if destroyed, degraded or rendered unavailable for an extended period, would significantly impact on the social or economic wellbeing of the nation or affect Australia's ability to conduct national defense and ensure national security.” At the European Union level, the term critical infrastructure is defined in two key documents. The first is the Green Paper on the Programme of Critical Infrastructure Protection [7], which was published in 2005 by the European Commission. The second is the Council Directive on the Identification and Designation of European Critical Infrastructures and on the Assessment of the Need to Increase Their Protection [10], which was published as a follow-up to the Green Paper in 2008. The council directive defines critical infrastructure as “an asset, system or part thereof located in Member States which is essential for the maintenance of vital societal functions, health, safety, security, economic or social wellbeing of people, and the disruption or destruction of which would have a significant impact in a Member State as a result of the failure to maintain those functions.”The directive leaves the responsibility for critical infrastructure protection to national authorities. Critical infrastructures are complex. In effect, critical infrastructures and their dependencies form a system of systems [20,25]. The overall critical infrastructure has an obvious hierarchy, consisting of individual sectors such as energy and transportation, along with their linkages [25]. The sectors consist of elements that are considered to be a basic part of the system. Currently, it is possible to distinguish two basic methodological approaches for the risk assessment of critical infrastructures. The first is the sectoral approach, where each sector is assessed separately with its own risk assessment methods. The second is the systems approach, where individual critical infrastructure sectors are deemed to be interconnected networks. Research in the critical infrastructure protection field [8,9] should improve the fidelity and precision of simulation tools for modeling the impact of critical infrastructure malfunctions [14]. The research should also be extended to the synergies and synergistic effects of infrastructure failures. Dynamic functional modeling [29] is a promising approach that can consider synergistic effects. However, it is currently used to simulate the systemic impacts on critical infrastructures (i.e., basic impacts without synergies) and does not support the modeling and simulation of synergistic effects. 2. National critical infrastructure system The hierarchic arrangement of a national critical infrastructure system has three levels that constitute a vertical classification: System level. Sector level. Element level. The system level is the basic classification of a critical infrastructure according to its functions. This level comprises: (i) the technical infrastructure and (ii) the socioeconomic infrastructure. For example, the technical infrastructure in the Czech Republic includes the energy, transport, water supply, food processing, agriculture, industry, and communications and information systems sectors. The socioeconomic infrastructure in the Czech Republic includes health care, financial and currency markets, emergency services and public administration. There are significant dependencies between the two types of critical infrastructure. For instance, all the socioeconomic sectors require the commodities produced by the technical infrastructure sectors. The technical sectors depend on the socioeconomic sectors, especially in crisis situations. The sector level is made up of the individual sectors of a critical infrastructure (e.g., energy and water supply). This level represents the classification of actual sectors of the critical infrastructure and their linkages. The individual components that form the element level are the basic building blocks of the system hierarchy of the sectors. The elements are relevant to the system due to the impacts produced by their failure. The elements can be classified into four categories based on their potential impacts [26].Table 1 provides a detailed description of the classification. In addition to the vertical categorization, it is also possible to view a critical infrastructure system with respect to its horizontal linkages. This creates a context with the surrounding processes and operators. The linkages define what impacts a critical infrastructure and what can be affected in the event of a failure. The correlation of the cause–failure–impact scenario international journal of critical infrastructure protection 14 (2016) 3–174 shown in Fig. 1 was identified on the basis of these linkages. The failure of critical infrastructure functions is caused by stimuli that have various intensity levels according to their character, scope and duration (i.e., Levels I–III emergencies). The impacts may have different levels based on the intensity levels of the causes and the resistance levels (protection) of the individual elements of a critical infrastructure system. The easiest way of identifying critical infrastructure elements is to use a bottom-up approach. In this approach, critical elements in one sector are gradually identified, starting with the elements at the lowest level, followed by selections of critical elements at progressively higher levels. However, this purely deterministic approach is no longer acceptable due to the strong cohesion of individual critical infrastructure sectors and, especially, the Table 1 –Classification of critical infrastructure system elements by impact. Categorization of the critical infrastructure system elements Description Critical infrastructure category III elements (elements at the local level) Disturbances of these elements impact social life in a municipality or municipal district. The disturbances lead to interruptions in the delivery of services (e.g., provision of food, electric power and potable water). A Level III Emergency (lowest level) is declared. The non-functional elements in this category are replaced by adopting special organizational measures or temporary solutions provided by emergency services (it is still possible to supply food, backup electric power and potable water). Critical infrastructure category II elements (elements at the regional level) Disturbances of these elements impact social life in several municipalities, municipal districts or an entire region. When the elements of this category are disrupted, the problem is solved by the infrastructure operators in cooperation with emergency services at the regional level. A Level II Emergency is declared and regulatory measures are adopted. Humanitarian aid is provided from national resources. Critical infrastructure category I elements (elements at the national level) Disturbances of these elements impact national security and the provision of essentials to citizens in two or more regions, or in an entire country. When the elements in this category are disrupted, the problem is solved by the infrastructure operators (based on approved crisis preparedness and emergency plans) in close cooperation with the ministries and central administration authorities responsible for the regions. The elements of this category are practically irreplaceable and their disruptions may only be resolved provisionally or through the use of resources secured in advance (e.g., water and fuel). A Level I Emergency is declared and regulatory measures are adopted. International humanitarian aid may be requested. Special critical infrastructure elements category (elements at the international level) Disturbances of these elements impact the national security of two or more states. A Level I Emergency is declared. Extensive regulatory measures are adopted and there is close international cooperation, coordination and organization of humanitarian aid (e.g., by the Emergency Response Coordination Centre [6] or the United Nations Office for the Coordination of Humanitarian Affairs [30]). Fig. 1 –Correlation between the intensity of cause, failure and impact in a critical infrastructure system. international journal of critical infrastructure protection 14 (2016) 3–17 5 linkages of their elements [24,25]. A better approach is to assess the joint causes and dependencies of the individual critical infrastructure sectors (not just each element individually) and their actual impacts. Researchers have devoted considerable effort to modeling and simulating the overall impact [21,33], not only on the interests protected by the state (i.e., security, economy and basic human needs [10]), but also on the elements of individual sectors (e.g., service loss, economic loss and reputation loss). 3. Critical infrastructure system linkages A critical infrastructure system and its organization must be viewed comprehensively, with the individual elements and sectors interlinked via various types of linkages (e.g., relations and connections). The basic structure of the linkages arises from their character. A one-way linkage represents an influence or dependency; a two-way linkage expresses an interdependency (see Fig. 2). Rinaldi et al. [25] have categorized interdependencies as physical, cyber, geographic and logical in nature, and they argue that interdependencies increase the risk of disturbances and failures in multiple interconnected infrastructures. Pederson et al. [24] have further categorized infrastructure linkages, providing lower levels of detail. Interested readers are referred to [13,15,19,27] for discussions of critical infrastructure interdependencies. All the types of linkages discussed above exist in a critical infrastructure system –at the vertical level (area-sectorelement) and at the horizontal level (cause-failure-impact). As shown in Fig. 3, the linkages occur at the following levels: Between elements of critical infrastructure sectors (i.e., cross-sectoral linkages). Between elements within a critical infrastructure sector (i.e., sectoral linkages). Between elements of a critical infrastructure and society. As with any network, a critical infrastructure system has elements with different levels of importance (criticality). The damage, disruption or failure of an important (critical) element has a more or less serious impact based on the number and character of linkages that define its level of effect, dependence or interdependence. A failure may not only cause a serious disruption of a sector or an entire critical infrastructure system, but it Fig. 2 –Types of linkages in a critical infrastructure system. Fig. 3 –Grid organization of linkages in a critical infrastructure system. international journal of critical infrastructure protection 14 (2016) 3–176 can also impact national interests such as security, the economy and basic human needs [10]. 4. Impacts of critical infrastructure system failures The prediction and subsequent minimization of the impacts of failures of individual elements, sectors and entire critical infrastructures are important components of critical infrastructure protection research. Prediction involves an analysis of all the available information about the nature of the impacts, which depend on several external and internal factors of the system of interest. The external factors include the resilience of society and the character, scope and duration of the event. The internal factors include the type and scope of the system failure inside the system; interested readers are referred to Rinaldi et al. [25] for details about system linkages and system resilience. The impacts are characterized by the scope, structure, intensity, duration and effects of the adverse event (see Fig. 4). A critical infrastructure system failure produces two types of impacts. The first type constitutes the negative impacts within the critical infrastructure system when the failure of one infrastructure sector causes a failure of another sector or its elements (i.e., cascading effect [25]). The second type corresponds to the negative impacts outside the system, specifically, on society, including national interests such as security, the economy and basic human needs [10]. In both cases, the impacts may be classified as direct or indirect from the structural point-of-view. The immediate effect of the disturbed sector on another sector or directly on society is considered to be a direct or primary action. In contrast, the indirect impacts occur implicitly through a sector of a critical infrastructure, regardless of whether or not it affects another sector or society as a whole. The indirect impacts may be secondary (through one sector) or multi-structural (through several sectors). Other important characteristics of an impact are its intensity and duration. The impact intensity depends on the scope of a sector failure (i.e., how it affects other sectors and the levels of sector interdependencies. When the linkages are weak, the impact intensity is low and the impact on other sectors is only partial. However, when the linkages are strong, the impact intensity is high and the impact on other sectors can be devastating (or absolute). The impact duration is obviously an important variable; the duration may be short-term, medium-term or long-term. Ouyang et al. [22] discuss the typical time progression of a critical infrastructure disruption, which is divided into: (i) a prevention period; (ii) a propagation period; and (iii) a damage, assessment and restoration period. Another important characteristic is impact effect. If the impact of a disrupted sector only influences another sector or society in one way, then the impact effect is referred to as a Fig. 4 –Aspects that create the character of impacts in a critical infrastructure system. international journal of critical infrastructure protection 14 (2016) 3–17 7 single impact. However, if the impact effects are multi-way (e.g., a combination of direct and indirect impacts) and occur in real-time, then the impact effects are synergistic in nature. The term synergy comes from the Greek syn-ergazomai, which means cooperation or joint action. Historically, the term has been used to describe the cooperation of several people and the theological notion of cooperation of man with God (synergism). Dictionary.com [5] describes synergy as “the interaction of elements that, when combined, produce a total effect that is greater than the sum of the individual elements, contributions, etc.”The online dictionary also defines synergy in physiology and medicine as a cooperative action of two or more muscles, nerves, or the like. In the areas of biochemistry and pharmacology, synergy is a cooperative action of two or more stimuli or drugs. In business management, synergism is the potential ability of individual organizations or groups to be more successful or productive as a result of a merger. The term synergy is used in various forms in many areas of human activity, but it has rarely been used in connection with the critical infrastructure. The first mention of synergy in the critical infrastructure domain was in 2001 [25], but only in the context of linkages in the economic infrastructure. Nevertheless, a classic example of synergistic effects in the critical infrastructure domain as emerged –the Fukushima Daiichi nuclear disaster of March 2011. The earthquake, tsunami and nuclear cooling system failure induced massive synergistic effects that may well continue to impact Japanese society for decades. Based on the discussion above, synergies potentially exist at all three horizontal levels of a critical infrastructure system: Synergy of emergencies (Level I synergy): This occurs due to the interactions of two and more emergencies on an element or sector of a critical infrastructure. Fig. 5 –Synergistic effects in a critical infrastructure system. international journal of critical infrastructure protection 14 (2016) 3–178 Synergy of elements or sectors (Level II synergy): This occurs due to the interactions of the impacts of failures of two or more critical infrastructure elements or sectors on a third critical infrastructure element or sector. Synergy of societal impacts (Level III synergy): This occurs as a result of the combined interactions of the impacts of failures of critical infrastructure elements or sectors with the impacts of emergencies on society. This creates an imaginary “ring of synergy”of all the current impacts on society. Fig. 5 shows the individual synergistic effects that can occur in a critical infrastructure system. The synergistic effects are created by the synergy of impacts and the aggregated effects of the interactions of impacts. This situation is symbolically expressed as 2 þ244or2þ2¼5. BusinessDictionary.com [2] defines synergistic effect as “an effect arising between two or more agents, entities, factors or substances that produces an effect greater than the sum of their individual effects.” Fig. 6 shows a simplified example of the synergistic effects arising from concurrent failures of two critical infrastructure sectors. Nieuwenhuijs et al. [19] have specified several functions to express the impacts between times t 1 and t 2 as well as between times t 3 and t 4 . In particular, Fig. 6 shows the impacts of the failures of unspecified energy sector elements and potable water sector elements. The failure of the energy sector has a social impact C E that occurs at time t 0 due to the effect of an emergency (e.g., storm). The failure of the potable water sector is the result of a cut-back at time t 1 , which causes the social impact to increase to CEþW. The maximum impact caused by the non-functioning of the two sectors occurs at time t 2 . During the time interval [t 1 ,t 3 ], a synergy of impacts exists (i.e., Level III synergy) of the energy and potable water sectors on society, which may lead to synergistic effects that increase the overall impact to CEþWþS. When the energy sector is restored at time t 3 , the synergies and synergistic effects cease. The restoration of the potable water sector continues until time t 4 . At the same time, the synergistic effects and, thus, the overall societal impact, may increase or decrease due to the concurrent effects of the non-functioning of two and more elements/sectors in the critical infrastructure. The opposite of a synergistic effect is an antagonistic effect, which is symbolically expressed as 2 þ2o4or 2þ2¼3. In physiology and medicine, this effect is described Fig. 6 –Course of the impact of failures of two critical infrastructure sectors with potential synergistic effects. international journal of critical infrastructure protection 14 (2016) 3–17 9 as “the opposing action of substances, like drugs, that –when taken together –decrease the effectiveness of at least one of them”[5]. In the case of a major event or disaster, the societal and psychological impacts may cause cascading impacts in the critical infrastructure, and common cause disruptions may be relegated to minor importance. Prediction of the synergistic effects in a critical infrastructure system is much more difficult than predicting impacts. While the variables involved in predicting single impacts are relatively obvious, the variables that determine the synergistic effects vary considerably and their specification is limited by the number and intensity of the emergencies, number of affected critical infrastructure sectors, resilience of the affected critical infrastructure sectors and societal vulnerabilities. Interested readers are referred to [18] for more information about this subject. 5. Synergistic effect impact quantification This section discusses the application of the SYNEFIA methodology to quantify the synergistic impacts arising from a critical infrastructure failure. The theoretical basis of the methodology is the notion of symmetric operational impacts –specifically, that the degree of an impact on society is directly proportional to the significance of a sector, sub-sector or element of the critical infrastructure system. This section applies the SYNEFIA methodology at the subsector level. In this case, the sub-sector significance is directly proportional to the activity and passivity of the sub-sector in the critical infrastructure system. The SYNEFIA methodology has five phases: 1. Critical infrastructure sub-sector identification. 2. Critical infrastructure sub-sector correlation analysis. 3. Critical infrastructure sub-sector significance determination. 4. Impact evaluation. 5. Synergistic effect determination. 5.1. Critical infrastructure sub-sector identification The identification phase creates an inventory of all the critical infrastructure sub-sectors that must be evaluated in the geographical region of interest (Fig. 1). This phase also determines the maximum number of sub-sectors to be considered in the geographical region of interest. The inventory is specific to each national critical infrastructure system. Indeed, the definition and designation of critical infrastructure sectors differs considerably for different countries [28]. For example, the Annex to the European Council Directive of 2008 [10] defines sub-sectors only for the energy and transport sectors. Consequently, an inventory of sub-sectors may have to be created for a geographical region, country or group of countries. 5.2. Critical infrastructure sub-sector correlation analysis The second phase evaluates the interactions between the sub-sectors of a critical infrastructure system. This research has employed the KARS method [23], which is primarily used for quantitative risk analysis based on risk correlation. The first step is to determine the correlations of the subsectors. The correlations are evaluated using pairwise comparisons that compare the importance of the two selected sub-sectors. The more important sub-sector from each pair is selected. Table 2 shows the correlation results. The second step is to determine the activities and passivities that are latent in each critical infrastructure sub-sector. The activity coefficient KASiof sub-sector S i expresses the full potential of sub-sector S i to cause failures of other subsectors. It is computed as: KASi¼Pn i¼1Ai n1ð1Þ where A i is the sum of the activity of sub-sector S i and nis the number of sub-sectors. The passivity coefficient KPSiof sub-sector S i expresses the potential that the other sub-sectors can cause a failure of sub-sector S i . It is computed as: KPSi¼Pn i¼1Pi n1ð2Þ where P i is the sum of the passivity of sub-sector S i and nis the number of sub-sectors. The passivity coefficients of the electricity and natural gas sub-sectors are determined to illustrate the computations. Using the data in Table 2 and applying Eq. (2), the passivity Table 2 –Correlation results. Index 12 3 4 Σ Index Critical infrastructure subsectors Si Electricity Natural gas Petroleum and petroleum products Water management Activity of sub-sector Ai 1Electricity x1 1 0 2 2Natural gas 1x 1 0 2 3Petroleum and petroleum products 11 x 0 2 4Water management 10 0 x 1 ΣPassivity of sub-sector Pi32 2 0 x x: Sub-sector failure can be caused internally. 1: Sub-sector Sican cause the failure of sub-sector Sj. 0: Sub-sector Sicannot cause the failure of sub-sector Sj. international journal of critical infrastructure protection 14 (2016) 3–1710 coefficient of the electricity sub-sector is equal to 1 (¼3/3) and the passivity of the natural gas sub-sector is equal to 0.67 (¼2/3). 5.3. Critical infrastructure sub-sector significance determination The significance of critical infrastructure sub-sectors is determined in two steps. In the first step, the quantification results are obtained by plotting each sub-sector on a graph based on its activity and passivity coefficients as shown in Fig. 7. The graph is then divided into four segments to classify the subsectors according to their significance. Segment I contains sub-sectors with the highest levels of influence and dependence (primary significance). Segment II contains sub-sectors with the highest level of dependence (secondary significance). Segment III contains sub-sectors with the highest influence (secondary significance). Segment IV contains subsectors with the lowest levels of influence and dependence (tertiary significance). In order to divide the graph into four segments, it is necessary to specify the lines P1 and P2. The parameters of the two lines are set using the Pareto Principle [16], which assumes that 80% of the sub-sectors are in Segment I (most significant critical infrastructure sub-sectors). The parameter P 1 of line P1 is computed as: P1¼KAmax ðKAmax KAmin Þ 100 80 ð3Þ where KAmaxis the maximum value of the activity coefficient and KAminis the minimum value of the activity coefficient. Similarly, the parameter P 2 of the line P2 is computed as: P2¼KPmax ðKPmax KPmin Þ 100 80 ð4Þ where KPmax is the maximum value of the passivity coefficient and KPmin is the minimum value of the passivity coefficient. In the second step, the significance of each sub-sector is determined mathematically as the simple sum of the subsector activity and passivity in the critical infrastructure system. Thus, sub-sectors with the higher composite levels of influence and dependence are considered to be more significant. The significance R i of sub-sector S i is given by: Ri¼KASiþKPSið5Þ where KASiis the activity coefficient of sub-sector S i and KPSi is the passivity coefficient of sub-sector S i . 5.4. Impact evaluation The fourth phase determines the impact of each sub-sector. The impact is computed as the ratio of the sub-sector failure impact to the overall critical infrastructure system failure impact. Note that, in this phase and in the next phase, the results are expressed as percentages. Thus, the impact (percentage) C i of sub-sector S i on society is computed as: Ci¼Ri Pn i¼1Ri 100 ð6Þ where R i is the significance of sub-sector S i and nis the number of sub-sectors. 5.5. Synergistic effect determination The fifth and final phase of the SYNEFIA methodology is to determine the synergistic effects. In particular, the synergistic effects due to cascading failures of two or more subsectors are computed. The synergistic effects can be viewed as arising from the lack of resilience of a critical infrastructure with respect to the impact of an incident, causing accumulative effects that increase the impact on the system and society. Fig. 8 presents a graphical representation of the synergistic effects due to disruptions to three sub-sectors. In the figure, an incident Xcauses a failure in sub-sector S 1 (e.g., electricity). The failure impacts society Yas well as other subsectors (e.g., S 2 ). The impacts are represented by C 1 . The failure in sub-sector S 1 causes a cascading effect at the same time due to the failure of sub-sector S 2 (e.g., Fig. 7 –Graphical representation of sub-sector significance. international journal of critical infrastructure protection 14 (2016) 3–17 11