Conversations on Strategy Podcast – Ep 13 – Alessandro Lazari – “Comparing Policy Frameworks - CISR in the United States and the European Union” from Enabling NATO’s Collective Defense CISR (NATO COE-DAT Handbook 1)

For over a quarter century the United States and the European Union have been diligently planning and implementing policies and procedures to protect the critical infrastructure sectors that are vital to the prosperity and security the majority of their citizens enjoy. Given the evolving nature of threats against critical infrastructure, recent US and EU efforts have focused on enhancing collective critical infrastructure security and resilience (CISR) posture. The core objective of these CISR initiatives is to strengthen their ability to deter, prevent, reduce the consequences of, respond to, and recover from a broad array of vulnerabilities, hazards, and threats to critical infrastructure. Any such disruptions to or destruction of these critical infrastructure systems and assets can have damaging impacts on individual nations, the transatlantic economy and security environment, and the ability of the North Atlantic Treaty Organization (NATO) to fulfill its core tasks.

This podcast is based on Chapter 10 in Enabling NATO’s Collective Defense: Critical Infrastructure Security and Resiliency (NATO COE-DAT Handbook 1). The goal of this chapter ultimately is to help Allies and partners better understand these two frameworks and apply their key principles and tenets to enhance the CISR posture in their respective countries.

Click here to read the book.

Click here to watch the webinar.

Episode Transcript: “Comparing Policy Frameworks: CISR in the United States and the European Union”

Stephanie Crider (Host)

You’re listening to Conversations on Strategy. The views and opinions expressed in this podcast are those of the authors and are not necessarily those of the Department of the Army, the US Army War College, or any other agency of the US government.

Conversations on Strategy welcomes Dr. Alessandro Lazari, coauthor of “Comparing Policy Frameworks: CISR in the United States and the European Union.”

Lazari’s been working as a specialist in critical infrastructure protection, resilience, and cybersecurity since 2004. He is currently a senior key account manager at 24 AG (F24 AG), focused on incident and crisis management in Europe.

Alessandro, welcome to Conversations on Strategy. I’m glad you’re here.

Alessandro Lazari

Thank you very much indeed for inviting me over. It’s a pleasure to be here.

Host

You recently contributed to the book Enabling NATO’s Collective Defense: Critical Infrastructure Security and Resiliency. The chapter you worked on compares policy frameworks of critical infrastructure security and resiliency in the US and the EU. The US (critical infrastructure security and resilience or) CISR framework: What do we need to know?

Lazari

I mean, thanks for asking about this. This has been part of my PhD studies—to go on deep between the lines about everything that the US has built in the past decades—and I have to say that this is really considerable. If you think that the (Presidential Decision Directive 63 or) PDD-63, just to give an example . . . presidential directive signed by (Bill) Clinton in May ’98 still stands as one of the brightest examples of CISR policies for a while—if you look at it nowadays, after so many years, you see how very well defined is the problem, how very well defined the mechanism to tackle it and to, you know, deal with it and to improve the overall posture of US against the threat of, you know, any potential attack to national critical infrastructure.

I mean, there is many examples in . . . in the US policies of things that really worked. I can tell that they constitute a milestone to which many, many countries are looking at because of the comprehensiveness. Because I can tell also that due to its particular system, (the) US has experienced a wide range of events that span across all the potential threats of critical infrastructure in the 50 states and as a federal system, so they’ve really wanted to organize something that is really very, very big.

Last but not least, the US has also considerable experience in maintaining the infrastructure. One of the greatest examples is the renovation that the US government did in the old railroad . . . you know, riverways in the ’40s and ’50s and ’60s is one . . . also a considerable milestone of the experience in the US. So, it’s very much worth looking at it because there is many countries that are now in the condition of tackling those challenges nowadays. So really, throughout the entire lifespan, you know, a lot of things that are really, you know, in use nowadays that really can provide example to the way the countries should deal with CISR nowadays.

Host

Let’s go into a little bit more detail. What currently guides the US CISR policy?

Lazari

One of the latest milestones in . . . in the US CISR policy is (Presidential Policy Directive 21 or) PPD-21, signed by Barack Obama in 2013. I mean, that can be considered one of the examples of the maturity of the policy in the US. You know, in announcing all the functional relationships among the very stakeholders involved in the life cycle of critical infrastructure security and resilience, there’s so many from both public and private side. From the public side, you have (the Department of Homeland Security or) DHS and all the departments that are involved, all the agencies, and from the other side, all the operators and the critical nodes within the country and so on and so forth. So, there is a considerable amount of stakeholders that need to talk to each other to be really aligned to do better. And here, we come to the second pillar that is information sharing.

Once you have identified all the functional relationship nodes, you absolutely need to cut short the distance between them. So they need to become closer and closer because they need to talk to each other, and in a country like (the) US, it’s very difficult because it’s a very big country with a big number of stakeholders involved. So for sure, this is also a challenge. And last but not least, after you have enabled, you know, the recognition of the functional relationship and the improvement of the information sharing, you then need to enable one very important pillar that is always mentioned in PPD-21: that is analysis of incident threats and emerging risk. Because you do not only deal with today, you also deal with the future. So you need to understand with . . . how, you know, uh, risks are evolving, so the emerging one . . . and you need to analyze all the incidents and threats constantly because the threats evolve as much as the society because, you know, we have new enemies, new ways to attack the systems, and history evolves; we all know that. So once you put together really this critical mass of activities and knowledge, you can say you are really structuring well all your policy on . . . on CISR.

Host

Tell me about the EU framework: European Programme for Critical Infrastructure Protection.

Lazari

The EU, it’s based on the membership of the member states that are part of the EU. There were 28, and, after the Brexit, now it’s 27. You know, every time, the negotiation of each steps of the policy is something that really seeks for the involvement of them all on proposal from the European Commission that is normally proposing new pieces of policy and regulation in this field. But this entails every time that member states are involved because they have a stake, they take a joint decision. But the European Programme for Critical Infrastructure Protection is really the very first milestone. As much as it is for PDD-63 in the case of US, it is really the very first piece of joint policy on critical infrastructure protection on the European side.

And this really comes immediately after the September 11 attacks to, you know, London and Madrid in 2004, 2005. It really starts from an all-hazard approach with a clear intent of fighting against terrorism. So, financing of terrorism, all aspects of dealing with terrorism and the impact of terrorism, terrorism of critical infrastructure. Then, immediately, the EU recognized within the program that the all-hazard approach really needs to be developed because it’s not only terrorism that can threaten the continuity, you know, and the existence itself of critical infrastructure, but there is many other threats that can really disrupt or create issues. So, the European program has really put together the member states for the first time ever in discussing the critical infrastructure protection.

This is still, nowadays, mainly the international level. The first thing you need: competency. It still relies on the member states that are part of the EU, but the program has, really, the 27 in the condition to discuss together all the challenges, all the state of play of each one of them. So to set new goals that are not overambitious for some of them, because you have to imagine when, in 2008, the European program was launched, there were five or six member states that really had a national framework for critical infrastructure protection, and many others that didn’t have one, or, you know, they really needed to amend it heavily because it was obsolete or not taken care of on all aspects.

It can be said that the European program has really created that first spark that has enabled the EU to be in the state of play it is nowadays because, for the first time, it has really asked the member states to discuss national security outside of their own border, but in a joint, coordinated manner.

Host<...