Conversations on Strategy Podcast – Ep 9 – Dr. Carol Evans – Enabling NATO’s Collective Defense CISR (NATO COE-DAT Handbook 1)

In 2014 NATO’s Centre of Excellence-Defence Against Terrorism (COE-DAT) launched the inaugural course on “Critical Infrastructure Protection Against Terrorist Attacks.” As this course garnered increased attendance and interest, the core lecturer team felt the need to update the course in critical infrastructure (CI) taking into account the shift from an emphasis on “protection” of CI assets to “security and resiliency.” What was lacking in the fields of academe, emergency management, and the industry practitioner community was a handbook that leveraged the collective subject matter expertise of the core lecturer team, a handbook that could serve to educate government leaders, state and private-sector owners and operators of critical infrastructure, academicians, and policymakers in NATO and partner countries. Enabling NATO’s Collective Defense: Critical Infrastructure Security and Resiliency is the culmination of such an effort, the first major collaborative research project under a Memorandum of Understanding between the US Army War College Strategic Studies Institute (SSI), and NATO COE-DAT.

The research project began in October 2020 with a series of four workshops hosted by SSI. The draft chapters for the book were completed in late January 2022. Little did the research team envision the Russian invasion of Ukraine in February this year. The Russian occupation of the Zaporizhzhya nuclear power plant, successive missile attacks against Ukraine’s electric generation and distribution facilities, rail transport, and cyberattacks against almost every sector of the country’s critical infrastructure have been on world display. Russian use of its gas supplies as a means of economic warfare against Europe—designed to undermine NATO unity and support for Ukraine—is another timely example of why adversaries, nation-states, and terrorists alike target critical infrastructure. Hence, the need for public-private sector partnerships to secure that infrastructure and build the resiliency to sustain it when attacked. Ukraine also highlights the need for NATO allies to understand where vulnerabilities exist in host nation infrastructure that will undermine collective defense and give more urgency to redressing and mitigating those fissures.

Click here to read the book.

Click here to watch the webinar.

Keywords: critical infrastructure, cyber threats, crisis management, weaponizing critical infrastructure, security risk assessment

Episode Transcript: Enabling NATO’s Collective Defense: Critical Infrastructure Security and Resiliency (NATO COE-DAT Handbook 1)

Stephanie Crider (Host)

You’re listening to Decisive Point, a US Army War College Press production focused on national security affairs.

The views and opinions expressed in this podcast are those of the authors and are not necessarily those of the Department of the Army, the US Army War College, or any other agency of the US government.

Decisive Point welcomes Dr. Carol V. Evans, editor of Enabling NATO’s Collective Defense: Infrastructure Security and Resiliency, which was published by the US Army War College Press in November 2022.

Evans is the director of the Strategic Studies Institute and the US Army War College Press. She brings 30 years of expertise in the areas of mission assurance, crisis and consequence management, asymmetric warfare, terrorism, maritime security, and homeland security. Since 2014, Evans has been a lecturer at the NATO Center of Excellence for the Defense Against Terrorism in Ankara, Turkey, where she teaches its Critical Infrastructure Protection Against Terrorist Attacks training program. She holds a Master of Science degree and a Doctor of Philosophy degree from the London School of Economics.

Thanks so much for joining me. I’m really excited to talk with you today.

You recently edited a book for NATO, Enabling NATO’s Collective Defense: Critical Infrastructure Security and Resilience. Why this book? Why now?

Dr. Carol Evans

Well, let me take a step back and that is explain to our audience why NATO? The SSI (Strategic Studies Institute) has had and enjoyed a very strong relationship with the NATO Center of Excellence (for the) Defense Against Terrorism in Ankara, Turkey. This book is the result of a joint research project between the two organizations. COE-DAT (it’s acronym) really focused on looking at critical infrastructure because terrorist attacks against that infrastructure have been increasing in time. And so, when we think about critical infrastructure and why now, we also need to examine the fact that infrastructure is being increasingly targeted; you just need to take a look at the news, for example, of the Russian attacks against the Ukraine infrastructure. Or if you look at, within Europe, strategic penetration by the PRC and some of their economic investments in telecommunications, in real estate, and even in the port infrastructure. All of this portends of two things. One, using critical infrastructure as a weapon of war, weaponizing that infrastructure. And so, we really need to understand critical infrastructure and the future of warfare. It’s going to be a tool for our adversaries. So, the timing was perfect for us in this book. It took about a year and a half in the making, but it is really so current and so relevant, given what we’re seeing happening right now on the battlefield.

Host

What can readers expect from this work? Can you give us an overview, please?

Evans

Sure, it’s a lengthy book, it’s I think, coming in at around 400 pages. First of all, I brought together a team of incredible international experts in critical infrastructure. Some of the authors come from high levels of government. Some of them are industry practitioners. Some of them come from academe. And some are from, you know, some of the most important government labs and other actual NATO centers of excellence. So, with this huge intellectual capability, we broke the book into four sections.

The first one looks at the evolution of threats to critical infrastructure, and we start with the basic question “What is critical infrastructure?” Luckily, both European and US definitions are in agreement, but we need to understand why infrastructure is so important and why it is being targeted and how has that threat to infrastructure evolved over time.

So that first section looks at (the) beginning with the kinetic threats to infrastructure. This is very much apropos of, sort of, terrorist means to target infrastructure, as we’ve also seen with Russia. I’m not saying they’re the same. I’m just simply saying we have states using kinetic attacks against infrastructure as well as terrorists. And then it has morphed; I guess about 10 years ago we saw increasing cyberattacks against that infrastructure, globally, and then hybrid warfare (where you have a mixture of both cyber and kinetic). So that’s sort of the first section.

Host

What does the second section cover?

Evans

Looking at what we call the lifeline sector. So, we wanted to provide case studies from each of the lifeline sectors, namely the energy sector, transportation sectors—so we have a chapter both on threats to civil aviation that has been often targeted, as you know, (not just airplanes but also airports). And also mass rail transit. You can harken back to Spain or the attacks against London and the underground.

Following transportation, we also look at telecommunications, and this is really important, as well as water. A lot of people don’t think about the water infrastructure, but it’s really really vital for many other infrastructures. And that’s why we call them lifeline(s)—because they’re so key to the quality of our life. And if you think about, particularly, energy—all of the other infrastructures rely on energy, so there is massive interdependencies between these infrastructures.

So each of the authors in those chapters really give some good case studies of both cyber and kinetic threats to that infrastructure and also discuss some of the measures, maybe to try and build that resiliency in our book, as you referenced, Critical Infrastructure Security and Resiliency. So both, how do we protect that infrastructure? But we know it’s going to go down at a certain point. Therefore, how do we build the resiliency back?

Host

What does the latter part of the book bring to the conversation?

Evans

It’s the tools and measures to build security and resiliency. What’s nice about this book is it’s not a US perspective. It is not a European perspective. We have authors from around the globe. And so they’re bringing their different backgrounds and subject matter expertise to help owners and operators or governments that have an infrastructure responsibility to think about what those tools might be. So, we first start with looking at both US and European frameworks—critical infrastructure, security resiliency frameworks—and what are then, sort of, the key policies. What are some of our key organizations? For example, here in the United States, it’s the Department of Homeland Security (and) CISA is the key organization. And then what are some other types of best practices that we can use, such as information and intelligence sharing? So, policies, practices, organizations, and how those frameworks have really helped incentivize both the government and private ...