Conversations on Strategy Podcast – Ep 11 – Chris Anderson – “Communications Resilience” from Enabling NATO’s Collective Defense CISR (NATO COE-DAT Handbook 1)

Communications form the critical backbone of the modern world, connecting more people and more devices more completely than ever before. The benefits of this hyper-connected society drive ever-increasing reliance on secure, reliable, and resilient communications. Potential adversaries to the North Atlantic Treaty Organization certainly understand the importance of communications—those they seek to target and those they use themselves—so it is critical to fully understand the sector, the risks it faces, and the best ways to mitigate those risks.

This podcast based on Chapter 9 in Enabling NATO’s Collective Defense: Critical Infrastructure Security and Resiliency (NATO COE-DAT Handbook 1) provides a foundation from which to better understand the criticality of communications for national security and emergency preparedness and common important characteristics of the sector and their implications for security and resilience.

Click here to read the book.

Click here to watch the webinar.

Keywords: communications, critical infrastructure, cyber threats, crisis management, security risk assessment

Episode transcript “Communications Resilience” from Enabling NATO’s Collective Defense: Critical Infrastructure Security and Resiliency (NATO COE-DAT Handbook 1)

Stephanie Crider (Host)

You’re listening to Conversations on Strategy. The views and opinions expressed in this podcast are those of the authors and are not necessarily those of the Department of the Army, the US Army War College, or any other agency of the US government. Conversations on Strategy welcomes Chris Anderson, author of “Communications Resilience.” Anderson’s, an incident management and infrastructure protection expert with three decades of government, military, and private-sector experience. He’s currently the principal advisor for national security and emergency preparedness at Lumen.

Welcome to Conversations on Strategy, Chris. I’m glad you’re here.

Chris Anderson

Thanks for having me.

Host

You recently contributed a chapter to Enabling NATO’s Collective Defense: Critical Infrastructure Security and Resiliency. Your chapter talks about communications resilience, the backbone of the modern world, in your words. Give us an overview of the communication sector, please.

Anderson

It’s really hard to overstate how important commercial communications is to government and military communications of all kinds. So, sort of the traditional national security kinds of things—command-and-control networks, intelligence sharing. Even highly classified information typically travels over commercial networks for a big part of its lifespan. But then as you start thinking even in more detail, things like civil preparedness, police, fire, EMS discussions, how you issue civil defense alerts to the civilian population, et cetera. On top of all that, communications is critical to economies and the citizenry in general.

In the US, we’ve started this concept called national critical functions, which sort of distinguishes the inherently governmental functions from the other things the nation needs to be able to do in order to have a vibrant economy and support the government and keep citizens safe, et cetera. And comms is really central to a lot of those national critical functions.

The sector itself is incredibly diverse. So when we talk about communications, and in the book chapter I talk about sort of the breadth of communications as encompassing sort of the traditional wireline services. You know, twisted pair copper and fiber optic cables that make up the old, you know, Bell telephone kind of networks that have now become the broadband connections that we all use in homes and businesses throughout the world. It also includes wireless communications. So wireless, you know, everyone thinks of 4G point-to-point5G cellular communications, but wireless also includes things like point-to-point, microwave and other uses of the radio frequency spectrum.

There’s the cable business, which is in some ways very similar to wireline. I like to stress cable in particular because I think there used to be a civil defense perspective of like, well, that’s not really critical infrastructure. You know, if somebody can’t watch Game of Thrones for a day or two, that’s not a big deal. But increasingly, the cable companies provide the same sort of broadband backhaul, for example, that enables wireless communications. So they’re really critical too.

Similarly, with broadcast. Broadcast TV and radio, not just about entertainment, but in some ways that is the most survivable, giving you that one-to-many communications capability to reach a large number of people. One of the things I like to say is, you know, “you can hand crank a radio. And so a citizen on their own, with nothing more than a radio with a hand—crank you can communicate with that person in a pinch.”

And then, of course, satellite networks which are themselves undergoing a massive transformation right now.

Across all five of those segments, though, there are a couple of things that I think are important to keep in mind as we think about communication resilience. Probably the biggest one is really over the last 20 years, the massive transition of communications technology from primarily analog to primarily digital. So the transition to Internet Protocol packets for voice, for video. Almost everything that’s pumped over radio frequency is now packetized, digitized, and then reassembled on the other end. That meshed and packetized network is, by its nature, resilient. The packets can travel multiple paths, and, in fact, that’s the whole design of the Internet. It was designed to be resilient, and if that path is no longer available, now I’ll go this path, and I’ll still get the packets there in time.

The market itself is highly competitive the different carriers and cross modes and within modes are fiercely competitive with each other. But at the same time, the nature of the business requires that we work closely together as well. So it’s this strange sort of coopertition (cooperation + competition) model that makes it all work.

You know, for example in interconnection, the whole point of communication networks are to be able to communicate with whomever you want. And so that means we have to exchange traffic with each other from carrier to carrier, from mode to mode, in order to get those packets where they need to go. And that interconnection implies a couple of really critical things. One is the importance of international standards so that things will work across these vast and disparate networks, (for example) the need for very big companies to work seamlessly with very small companies who have very different perspectives on how to operate their networks. And it also means that we’re generally interconnected with potential adversaries. So the network of networks that is the Internet has a lot of players on there and not all of them have our best interests at heart.

The last thing I think is important to understand about communications is just how tightly integrated we are with other critical infrastructures. Pretty much every other critical infrastructure relies on comms for it to be able to function in its normal capacity. And comms is itself reliant on other critical infrastructures—in particular, heavily reliant on commercial electric power. And where commercial electric power is either out because of a temporary disturbance or is simply not available, then the continued availability of liquid fuels for on-site generation becomes really, really important.

Host

Let’s talk about threats to communications. What are the ways in which the integrity, availability, or confidentiality of communication systems might be degraded or compromised?

Anderson

In the book, I talked through the “Big Three” set of things that can impact communications infrastructure. The first one is natural disaster and there’s physical attack. And I’ll lump in there industrial mishap kinds of accidental damages. And then same thing on the cyber front. There is cyberattack and cyber misconfiguration mistake kind of issues. There are some similarities across those three and some differences to tease out among them.

So in terms of natural disaster, you know, sort of the gamut of bad things Mother Nature can throw at us also damage information systems and communication networks. So that’s storms, hurricanes and tornadoes, and derechos and you name it. Those can variously cause different types of physical damage either to key facilities (central offices, Internet exchange points, or to conduits, either underground cabling or aerial fiber. Stuff that’s not aerial, tends to be more susceptible to things like flooding or even to things like train derailments, or things that can damage the conduits—earthquakes for example). The other thing that natural disasters tend to do is impact the availability of commercial electricity. So if commercial electricity isn’t available then access to alternate fuel sources becomes really important.

There’s also Mother Earth’s environment. So there’s geomagnetic storms and space weather that can impact satellites and can impact, depending on the frequency bands, radio frequency spectrum to varying degrees.

Transitioning more to sort of the man-made attacks. Physical attacks. Either attack...