The Invisible Hand? Critical Information Infrastructures, Commercialisation and National Security

Abstract

Corporatisation of critical information infrastructure (CII) is rooted in the 'privatisation wave' of the 1980s-90s, when the ground was laid for outsourcing public utilities. Despite well-known risks relating to reliability, resilience, and accountability, commitment to efficiency imperatives have driven governments to outsource key public services and infrastructures. A recent illustrative case with enormous implications is the 2017 Swedish ICT scandal, where outsourcing of CII caused major security breaches. With the transfer of the Swedish Transport Agency's ICT system to IBM and subcontractors, classified data and protected identities were made accessible to non-vetted foreign private employees -sensitive data could thus now be in anyone's hands. This case clearly demonstrates accountability gaps that can arise in public-private governance of CII.In order to produce, operate and distribute public services and goods to citizens, modern, post-industrial societies rely on complicated logistics systems and intricate asset network architectures. Critical infrastructures can be likened to the arteries and veins of human beings, without which it would be quite impossible for them to function. Essentially, this is why infrastructures such as those for energy, transport, communications and financial services are defined as critical.1 As large and complex systems, catastrophic effects could follow if they were to break down. 2Due to rapid technological development and increasing dependence on information and communications technology (ICT), most of these infrastructures are now operated, managed and/or controlled via interconnected computer networks and information flows, so that they have essentially become critical information infrastructures (CII).3 Elaborating on the body metaphor, this can be seen as the equivalent of adding nerves to the arteries and veins. In the past, destroying or even disrupting physical infrastructures required Dunn-cavelty and Suter, "The art of cIIp Strategy".

Targeting Reputation: A New Vector for Attacks to Critical Infrastructures

“…Energy, money, information and other goods and services are accurately distributed thanks to the cyber-physical, critical infrastructures, hence it is hardly surprising that cyber-attacks, of various types and for different purposes, have been on the rise. ii At the same time, the literature on cases of privatized utilities not responding well and efficiently to critical emergencies is now large and established (e.g., Sheil, 2000;Palm, 2008;Newlove-Eriksson, Giacomello & Eriksson 2018). Moreover, literature reviews show that cyber-attacks have a negative impact on the market value of companies (Modi, Sachin, Wiles, & Mishra 2015;Berkman et al, 2018), which then have to invest greater money into their security.…”

Who Should Be in Charge of Cyberspace? The European Union, Member States and the Constitution of Structural Power

“…Private actors in general and corporate firms in particular are the protagonists in constructing, operating and partly protecting cyberspace (Choucri, 2012: 40;Healey, 2013;Newlove-Eriksson et al, 2018). For instance, the private sector controls about 90 per cent of the critical infrastructure in the United States (US) (Singer and Friedman, 2014: 15).…”

“…In this sense, it is covert and may exist without observable conflict, whereas these structural positions, in fact, shape unequal political privileges (see also, Weiss, 2009). Against the backdrop of the vivid debate on overt power struggles (Carrapico and Barrinha, 2017;Newlove-Eriksson et al, 2018), this paper seeks, by contrast, to explore the historically contingent constitution of structural power in order to draw inferences about Europe's main actors' positions within the contemporary contests over ruling cyberspace.…”

Accountability and Patchwork Governance in Urban Rail Interchanges: Junctions of London Crossrail and Stockholm City Line Compared

“…The Stockholm County Council as well as Trafikverket (the national transport agency) are committed to outsourcing management and operations of public transport (Ek Österberg, 2016; Hedström et al, 2016; Norén, 2014). These developments follow a general New Public Management (NPM) trend, where public works and services have been deregulated and opened for competition—also within the domain of safety and security (Newlove-Eriksson, Giacomello, & Eriksson, 2018; Tulumello, 2017). This now well established outsourcing concept has been criticized for leading to lack of transparency and clarity in responsibility for work done by different entrepreneurs in the City Line project, as well as to an inadequate working environment from the perspective of employees and unions; safety representatives, for example, are unable to gain access to and assess workplaces (Nordlund & Lönnström, 2013; Sanne, 2015).…”