New governance of corporate cybersecurity: a case study of the petrochemical industry in the Port of Rotterdam

Abstract

The petro-chemical industry is a critical infrastructure that is vulnerable to cybercrime. In particular, industrial process control systems contain many vulnerabilities and are known targets for hackers. A cyberattack to a chemical facility can cause enormous risks to the economy, the environment, and public health and safety. This gives rise to the question how corporate cybersecurity has developed; how it is governed; and whether it should be subject to public oversight. This paper presents a case study of the governance of cybersecurity in the petrochemical industry in the Rotterdam Mainport area in the Netherlands, which reflects the 'new governance' view that cybersecurity can best be governed through voluntary public-private partnerships. The paper finds however that actual collaborative governance is not developing in the petrochemical industry in the port of Rotterdam; that corporate awareness and investment in cybersecurity stay behind standards, and that cybersecurity is not included in regulatory inspections. The paper places these findings in the context of three problems often associated with 'new governance' particularly pressing in cybersecurity governance: a weak role of government in publicprivate collaborative arrangements; an expectation that businesses will invest in self-regulation even in the absence of incentives to do so, and a lack of information exchange. In the port of Rotterdam, these problems result in a lack of obligations and accountability pressure on petrochemical corporations, leaving on of the most important chemical industrial hazards of today, largely unregulated. Crime Law Soc Change (2017) 68:75-93

Assessing and Proposing Countermeasures for Cyber-Security Attacks

“…To identify the assets related to the system, system functions were first had identified [32][33][34][35][36][37][38]. The scope of the risk assessment was the company's booking system, represented by an application that provides reservation and ticketing services to various transport sectors through the company's digital channels (see Table IV).…”

Regulation and governance versus criminology: Disciplinary divides, intersections, and opportunities

“…It should also pay more attention to the punitive capacity of a fuller range of private and informal "sanctions," including professional bans, media "naming and shaming" campaigns ( van Erp 2011), social media accountability (Grabosky 2013), and systems of civil penalties, that contribute to the practice of corporate social control (Black 2002). The growing recognition of private security (closed-circuit TV, private policing) and administrative sanctioning (such as anti-social behavior orders in the UK) within mainstream criminology, along with the increasing use made of corporate policing to enable secrecy and control, and to limit reputational damage (Meerts 2014; van Erp 2017), suggests that there is a pressing need for corporate criminology scholarship to expand its focus to account for these variations (Bures & Carrapico 2017).…”

“…On the other hand, regulatory governance scholars sometimes appear to paint too rosy a picture of publicprivate collaborative governance, private regulation, and the power of market sanctions (Coen & Pegram 2015). The capacity of private actors and public-private governance networks to process information, avoid "groupthink," and support accountability, have been found to be limited by empirical studies across a variety of sectors, from banking (Ford 2010), to deepwater drilling (Mills & Koliba 2015), to cybersecurity ( van Erp 2017). Common flaws found in such settings include a tendency for self-reinforcing "confirmation biases" to emerge in the decisionmaking of regulatory actors who closely share both operational assumptions and industry cultures (Ford 2010, p. 485;Mills & Koliba 2015, p. 86).…”