Critical Infrastructure Resilience and Sustainability Reader Ted G Lewis Full Chapter

Critical Infrastructure Resilience and
Sustainability Reader Ted G. Lewis

Visit to download the full and correct content document:
https://ebookmass.com/product/critical-infrastructure-resilience-and-sustainability-rea
der-ted-g-lewis/
Critical Infrastructure Resilience
and Sustainability Reader
Critical Infrastructure Resilience
and Sustainability Reader
Ted G. Lewis
Naval Postgraduate School (ret.)
Montery, California, USA
Copyright © 2024 by John Wiley & Sons, Inc. All rights reserved.
Published by John Wiley & Sons, Inc., Hoboken, New Jersey.

Published simultaneously in Canada.
No part of this publication may be reproduced, stored in a retrieval system, or transmitted in any form or by any means, electronic, mechanical,
photocopying, recording, scanning, or otherwise, except as permitted under Section 107 or 108 of the 1976 United States Copyright Act,
without either the prior written permission of the Publisher, or authorization through payment of the appropriate per-copy fee to the Copyright
Clearance Center, Inc., 222 Rosewood Drive, Danvers, MA 01923, (978) 750-8400, fax (978) 750-4470, or on the web at www.copyright.com.
Requests to the Publisher for permission should be addressed to the Permissions Department, John Wiley & Sons, Inc., 111 River Street,
Hoboken, NJ 07030, (201) 748-6011, fax (201) 748-6008, or online at http://www.wiley.com/go/permission.
Trademarks: Wiley and the Wiley logo are trademarks or registered trademarks of John Wiley & Sons, Inc. and/or its affiliates in the United
States and other countries and may not be used without written permission. All other trademarks are the property of their respective owners.
John Wiley & Sons, Inc. is not associated with any product or vendor mentioned in this book.
Limit of Liability/Disclaimer of Warranty: While the publisher and author have used their best efforts in preparing this book, they make no
representations or warranties with respect to the accuracy or completeness of the contents of this book and specifically disclaim any implied
warranties of merchantability or fitness for a particular purpose. No warranty may be created or extended by sales representatives or written
sales materials. The advice and strategies contained herein may not be suitable for your situation. You should consult with a professional where
appropriate. Further, readers should be aware that websites listed in this work may have changed or disappeared between when this work was
written and when it was read. Neither the publisher nor authors shall be liable for any loss of profit or any other commercial damages, including
but not limited to special, incidental, consequential, or other damages.
For general information on our other products and services or for technical support, please contact our Customer Care Department within the
United States at (800) 762-2974, outside the United States at (317) 572-3993 or fax (317) 572-4002.
Wiley also publishes its books in a variety of electronic formats. Some content that appears in print may not be available in electronic formats.
For more information about Wiley products, visit our website at www.wiley.com.
Library of Congress Cataloging-in-Publication Data applied for:

ISBN: 9781394179527 (PB); 9781394179534 (ePDF); 9781394179541 (epub)
Cover Design: Wiley

Cover Image: © Bim/Getty Images
Set in 9.5/12.5pt STIXTwoText by Straive, Pondicherry, India

v
Contents
Preface xiii
1 The Challenge 1
1.1 The Evolution of Critical Infrastructure Protection 2
1.1.1 In the Beginning 2
1.1.2 Natural Disaster Recovery 4
1.1.3 What Is Critical? 5
1.1.4 Public–Private Cooperation 7
1.1.5 Federalism: Whole of Government 8
1.2 Defining CIKR Risk and Resilience 11
1.2.1 Risk Strategy 12
1.2.2 Resilience Strategy 13
1.2.3 Sustainability Strategy 14
1.2.4 The Four Horsemen 15
1.3 Weather/Climate Change/Global Warming 16
1.3.1 The Carrington Event 17
1.3.2 Black Bodies 18
1.3.3 The Lightening Rod 19
1.4 Consequences 20
1.4.1 Accidents/Aging/Neglect 21
1.4.2 The Report Card 21
1.4.2.1 The Domino Effect 22
1.4.3 Terrorism/Extremists 22
1.4.4 Cyber Exploits/Criminals 25
1.4.4.1 Black Hats 25
1.4.4.2 Cybercrime Pays 26
1.4.5 The Soft War 27
1.4.6 Cyberattacks and CIKR 27
1.5 Discussion 29
References 29
2 What is a Catastrophe? 30
2.1 Theories of Collapse 31
2.1.1 Normal Accident Theory (NAT) 32
2.1.2 Punctuated Equilibrium Theory (PET) 33
2.1.3 How Uncertain are Avalanches? 33
2.1.4 Self-Organized Criticality 35
2.2 Complex Systems Theory 36
2.2.1 Tragedy of the Commons (TOC) 36
2.2.2 Paradox of Enrichment (POE) 38
2.2.3 Competitive Exclusion Principle (CEP) 41
vi Contents
2.2.4 Paradox of Redundancy (POR) 43

2.3 General Systems Theory 43
2.3.1 Emergence 43
2.3.2 Self-Organization 44
2.3.3 Preferential Attachment 44
2.4 Vulnerable Industrial Commons 46
2.4.1 TOC Failure 46
2.4.2 POE Failure 47
2.4.3 CEP Failure 47
2.4.4 POR Failure 47
2.5 Resilience Versus Sustainability 48
2.5.1 Black Swans 48
2.5.2 Catastrophe’s Long Tail 49
2.6 Discussion 49
References 49
3 Energy Transition 51
3.1 A Sector Under Transition 51
3.2 Energy Fundamentals 52
3.2.1 Understanding Units and Measures 53
3.2.2 Consumption 54
3.3 Regulatory Structure of the Energy Sector 55
3.3.1 Evolution of Energy Sector Regulation 55
3.3.2 Energy Pipeline Regulations 55
3.3.3 The Energy ISAC 56
3.4 Legacy Fuels 56
3.4.1 Coal 57
3.4.2 The Rise of Oil and the Automobile 57
3.4.3 Natural Gas Middlemen 58
3.4.4 Nuclear Fuel 58
3.5 Legacy Energy Infrastructure 61
3.5.1 Oil Refineries 61
3.5.2 Oil Transmission and Distribution 62
3.5.3 Oil Storage 63
3.5.4 The Natural Gas Supply Chain 64
3.5.5 The Critical Gulf of Mexico Cluster 65
3.5.6 Critical Refineries 65
3.5.7 Critical Transmission Pipelines 66
3.6 Renewables 66
3.7 Solar – Photovoltaic (PV) 67
3.7.1 Wind 67
3.7.2 The Hydrogen Circle 68
3.7.3 Others 69
3.8 Batteries and Reservoirs 70
3.8.1 Modern Batteries 70
3.8.2 Grid Scale Storage – LDES 71
3.9 Discussion 71
References 72
4 The Vulnerable Powergrid 73

4.1 What Is the Grid? 74
4.2 The North American Grid 76
Contents vii
4.2.1 Grid Structure 77

4.2.2 ACE and Kirchhoff’s Law 78
4.2.3 Anatomy of a Blackout 78
4.3 Threat Analysis 80
4.3.1 Attack Scenario 1: Disruption of Fuel Supply to Power Plants 80
4.3.2 Attack Scenario 2: Destruction of Major Transformers 81
4.3.3 Attack Scenario 3: Disruption of SCADA Communications 81
4.3.4 Attack Scenario 4: Creation of a Cascading Transmission Failure 82
4.4 From Death Rays to Vertical Integration 83
4.4.1 Early Regulation 83
4.4.2 Deregulation and EPACT 1992 85
4.4.3 Electricity Sector ES-ISAC 85
4.5 Out of Orders 888 and 889 Comes Chaos 86
4.5.1 Economics Versus Physics 88
4.5.2 What Increases SOC? 89
4.5.3 NIMBY Versus Environmentalism 90
4.5.4 A Change of Heart 91
4.6 The Architecture of Twenty-First Century Grids 91
4.6.1 The Future Is Storage 92
4.6.2 SOC Is Reduced 94
4.6.3 Economics of Electrification 95
4.7 Discussion 96
References 96
5 Water and Water Treatment 97

5.1 A Vanishing Resource 97
5.1.1 From Germs to Terrorists 98
5.1.2 Safe Drinking Water Act 99
5.1.3 The WaterISAC 100
5.2 Foundations: SDWA of 1974 101
5.3 The Bio-Terrorism Act of 2002 102
5.3.1 Is Water for Drinking? 103
5.3.2 Climate Change and Rot – The New Threats 103
5.4 The Architecture of Water Systems 104
5.4.1 The Law of the River 105
5.4.2 Resiliency of Water Pipeline Networks 105
5.5 Hetch Hetchy Water 106
5.5.1 Risk Analysis 108
5.5.2 Resilience Analysis 108
5.6 Threat Analysis 108
5.6.1 The Rational Actor 109
5.6.2 Hetch Hetchy Threat Analysis 109
5.6.3 Chem-Bio 109
5.6.4 Earthquakes 110
5.7 Water Resilience 110
5.7.1 Save the Pineapple Express 110
5.7.2 Gray Water 112
5.7.3 Desalination 112
5.7.4 Exemplar Israel 113
5.8 Discussion 113
References 113
viii Contents
6 Transportation Renewed 114

6.1 Transitioning a Vast and Complex Sector 114
6.1.1 Government Leads the Way 115
6.1.2 Safety and Security 115
6.2 Roads at TOC Risk 116
6.2.1 The Road to Prosperity 119
6.2.2 Economic Impact 120
6.2.3 The National Highway System (NHS) 120
6.2.4 The Interstate Highway Network is Resilient 121
6.2.5 The NHS is Safer 121
6.2.6 The Future is Electric 122
6.3 Rail and Railroads 122
6.3.1 Birth of Regulation 123
6.3.2 Freight Trains 125
6.3.3 Passenger Rail 126
6.3.4 Terrorist Target Passenger Trains 127
6.3.5 Economics of Rail 127
6.4 Air Transportation 129
6.4.1 Resilience of the Hub-and-Spoke Network 130
6.4.2 Security of Commercial Air Travel 132
6.4.3 How Safe and Secure is Flying in the United States? 134
6.4.4 Drones 134
6.4.5 eVTOLs 135
6.4.6 Commercial Airline Impact on Global Warming 135
6.5 Discussion 135
References 136
7 Supply Chains 137

7.1 The World is Flat, but Tilted 139
7.1.1 Supply Side Supply 140
7.1.2 The Father of Containerization 140
7.1.3 The Perils of Efficient Supply Chains 141
7.2 The World Trade Web 144
7.2.1 WTW and Economic Contagions 145
7.2.2 Resilience Failures 147
7.3 TWIC 148
7.3.1 MSRAM 148
7.3.2 PROTECT 150
7.4 Sustainable and Resilient Supply Chains 151
7.4.1 Greening of Ships 151
7.5 Are Supply Chains Secure? 151
7.5.1 Encapsulation Works 152
7.5.2 Who Owns the Trusted Path? 152
7.6 Discussion 152
References 153
8 Communications and the Internet 154

8.1 Early Years 156
8.1.1 The Natural Monopoly 157
8.1.2 The Communications Act of 1996 158
8.2 Regulatory Structure 158
8.2.1 The Most Important Person in Modern History 159
Contents ix
8.2.2 The First (Modern) Critical Infrastructure 159

8.3 The Architecture of the Communications Sector 160
8.3.1 Physical Infrastructure 161
8.3.2 Wireless Networks 163
8.3.3 Extra-Terrestrial Communication 163
8.3.4 Land Earth Stations 165
8.3.5 Cellular Networks 165
8.3.6 Cell Phone Generations 166
8.3.7 Wi-Fi Technology 166
8.4 Risk and Resilience Analysis 167
8.4.1 Importance of Carrier Hotels 168
8.4.2 The Submarine Cable Network 169
8.4.3 HPM Threats 169
8.4.4 Cellular Network Threats 170
8.4.5 Physical Threats 171
8.5 The Monoculture Internet 171
8.5.1 The Internet Self-Organized 172
8.5.2 The Original Sins 173
8.5.2.1 The DNS 174
8.5.2.2 More Original Sin 175
8.5.3 The Hierarchical Internet 176
8.5.4 Too Many Open Ports 177
8.6 Internet Governance 177
8.6.1 IAB and IETF 178
8.6.2 ICANN Wars 179
8.6.3 ISOC 180
8.6.4 W3C 180
8.6.5 Internationalization 181
8.6.6 Regulation and Balkanization 182
8.6.6.1 Rise of Regulation 182
8.6.6.2 Criticality of the Internet 183
8.7 Green Communications 183
8.7.1 Solar Computing 183
8.7.2 Quantum Communications 184
8.7.3 Adiabatic Logic 184
8.8 Discussion 184
References 185
9 Cyber Threats 186

9.1 Threat Surface 188
9.1.1 Script-kiddies 191
9.1.2 Black Hats 191
9.1.3 Weaponized Exploits 192
9.1.4 Ransomware and the NSA 193
9.2 Basic Vulnerabilities 194
9.2.1 The First Exploit 195
9.2.2 TCP/IP Flaws 196
9.2.3 Open Ports 198
9.2.4 Buffer Overflow Exploits 199
9.2.5 DDoS Attacks 200
9.2.6 Email Exploits 201
9.2.7 Flawed Application and System Software 201
x Contents
9.2.8 Trojans, Worms, Viruses, and Keyloggers 202

9.2.9 Hacking the DNS 203
9.2.10 Hardware Flaws 203
9.2.11 Botnets 204
9.3 Cyber Risk Analysis 205
9.3.1 Kill Chain Approach 206
9.3.2 Machine-learning Approach 206
9.4 Analysis 207
9.5 Discussion 208
References 208
10 Social Hacking 209

10.1 Web 2.0 and the Social Network 211
10.2 Social Networks Amplify Memes 213
10.3 Topology Matters 215
10.4 Computational Propaganda 217
10.5 Beware the Echo Chamber 218
10.6 Big Data Analytics 219
10.6.1 Algorithmic Bias 220
10.6.2 The Depths of Deep Learning 221
10.6.3 Data Brokers 221
10.7 GDPR 222
10.8 Social Network Resilience 223
10.9 The Sustainable Web 224
10.9.1 The Century of Regulation 225
10.9.2 The NetzDG 225
10.10 Discussion 226
References 227
11 Banking and Finance 228

11.1 The Financial System 231
11.1.1 Federal Reserve Versus US Treasury 232
11.1.2 Operating the System 233
11.1.3 Balancing the Balance Sheet 233
11.1.4 Paradox of Enrichment 234
11.2 Financial Networks 235
11.2.1 FedWire 235
11.2.2 TARGET 236
11.2.3 SWIFT 236
11.2.4 Credit Card Networks 237
11.2.5 3-D Secure Payment 237
11.3 Virtual Currency 238
11.3.1 Intermediary PayPal 238
11.3.2 ApplePay 239
11.3.3 Cryptocurrency 239
11.3.3.1 Nakamoto’s Revenge 240
11.3.3.2 Double Spend Problem 240
11.3.3.3 Crypto Challenges 241
11.4 Hacking a Financial Network 242
11.5 Hot Money 244
11.5.1 Liquidity Traps 244
11.5.2 The Dutch Disease 245
Contents xi
11.6 The End of Stimulus? 246

11.7 Fractal Markets 246
11.7.1 Efficient Market Hypothesis (EMH) 247
11.7.2 Fractal Market Hypothesis (FMH) 248
11.7.3 Predicting Collapse 248
11.8 The Threat is Existential 250
11.9 Discussion 250
References 250
12 Strategies for a Changing World 251

12.1 Whole of Government 252
12.2 Risk and Resilience 253
12.3 Complex and Emergent CIKR 255
12.3.1 Communications and IT 255
12.3.2 Internet and Cybersecurity 256
12.4 Surveillance Capitalism 256
12.5 Industrial Control Systems 257
12.6 Global Pandemics 257
12.7 Transportation and Supply Chains 258
12.8 Banking and Finance 258
12.9 An Integrated Infrastructure Strategy 259
12.9.1 What to Do? 259
12.9.2 The Plan 260
12.9.3 Issues 260
12.10 Discussion 261
Index 262
xiii
Preface
I wrote this book as a companion to the third edition of Critical Infrastructure Protection in Homeland Security: Defending
a Networked Nation, 2020. It is intended to be a more casual compendium suitable for the curious reader interested in the
broad issues of critical infrastructure rather than a formal and rigorous textbook. I hope the reader agrees.
During the 20-year evolution of critical infrastructure studies, from the fear of terrorism, to the daunting problems of
cybersecurity, and finally to the challenges of rouge nation-states and domestic terrorism, infrastructure became a national
security concern for an entirely different reason – climate change. The world is now facing an existential crisis posed by the
byproducts of the industrial revolution – pollution. We have come to the end of the 150-year trail. Now it is time to address
the challenge of climate change precipitated by pollution. There is simply too much greenhouse gas (GHG) being emitted
into the atmosphere and too much pollution (plastics, etc.) spewing into our water and soil. We are in danger of extinction
by our own hands!
As it turns out, most of the problem lands squarely on critical infrastructure systems. According to the US EPA, in 2020,
the United States emitted nearly six billion metric tons of GHGs. Carbon dioxide accounted for the largest percentage
(79%), followed by methane (11%), nitrous oxide (7%), and other GHGs (3%). Total US emissions for 2019 totaled 6558 mil-
lion metric tons of CO2 and net emissions, taking sinks into account, totaled 5769 million metric tons of CO2 equivalent.
Greenhouse gases are emitted by all sectors of the economy, including electric power (25% of total), transportation (29%),
industry (23%), residential and commercial (13%), and agriculture (10%).1
While all sectors emit GHG, it is interesting to note that a handful of critical infrastructure sectors account for the major-
ity of emissions: electric power, transportation, and agriculture combined account for nearly two-thirds! Thus, the problem
may be manageable by addressing a rather narrow – but large – segment of the economy. This is the good news. The bad
news is that it is an enormous challenge to turn around such a large entrenched ship!
My strategy is to advocate for circular economics in each of the main sectors that contribute the most to climate change.
Circular economics is the economics of recycling and reusing materials and processes. It involves the use of renewable
energy to power the planet and greater efficiencies in production, transportation, and consumption. I show that in each
instance it is possible to turn the tide by carefully thinking about how to “recycle” and replenish the Earth’s assets while at
the same time building on the ever-expanding need for energy, transportation, and agriculture.
We are now at the stage of development where it is entirely possible – even profitable – to implement circular eco-
nomics in every sector. Within the United States, we are on the verge of a 10–20-year revision of the most critical of all
infrastructures – energy, transportation, and agriculture. This will have a ripple effect on adjacent infrastructure systems
such as water and water systems, banking and finance, supply chains, and cybersecurity.
Circular economics requires different thinking. In particular, we must concern ourselves with externalities like the
impact of dumping industrial byproducts into the river and pumping byproducts of industrial processes into the air. What
once was “free,” is no longer free. These externalities must be paid for or eliminated. For example, petroleum-powered
automobiles produce CO2, which is no longer free. It extracts a price in terms of global warming, illnesses, and social
unrest. And while the solution is to electrify transportation, electrification is not free, either. Electrification creates a long
supply chain, each stage at which, there is an opportunity to adopt a circular economy – or not! This is the central theme
of resilience and sustainability.
1 https://www.c2es.org/content/u-s-emissions.
xiv Preface
The passage of the Inflation Reduction Act (IRA) commits the United States to billions of dollars to address aging
infrastructure systems, signals the beginning of the Great Sustainability Movement, and accelerates the transition to resil-
ient and sustainable infrastructure systems. It will unfold dramatically over the following years and be characterized by
sorely needed resilience – the ability to absorb and recover from faults – and sustainability – a property of infrastructure
that allows it to operate and last for an indefinite length of time.
Second, the threat posed by cybercriminals will only intensify as ultra-sophisticated technologies such as artificial intel-
ligence (AI), machine learning (ML), and large language models (LLM) become commonplace. Abuse of social networks
and online interaction pales compared with the potential abuses of these powerful technologies. Ultimately, they must be
tamed by regulation, but that will not stop criminals and enemies of the state from using them. We must prepare ourselves
by mastering and taming cybersecurity. Hence, the emphasis of this edition of critical infrastructure protection is on cyber-
security as well as resilience and sustainability.
The theme of this edition is resilience and sustainability in the age of existential risk due to climate change. The oppor-
tunity is in the Great Sustainability Movement of revising critical infrastructures for the twenty-first century and beyond.
Ted G. Lewis
March 2023
1
The Challenge
CHAPTER MENU
1.1 T he Evolution of Critical Infrastructure Protection, 2
1.1.1 In the Beginning, 2
1.1.2 Natural Disaster Recovery, 4
1.1.3 What Is Critical?, 5
1.1.4 Public–Private Cooperation, 7
1.1.5 Federalism: Whole of Government, 8
1.2 Defining CIKR Risk and Resilience, 11
1.2.1 Risk Strategy, 12
1.2.2 Resilience Strategy, 13
1.2.3 Sustainability Strategy, 14
1.2.4 The Four Horsemen, 15
1.3 Weather/Climate Change/Global Warming, 16
1.3.1 The Carrington Event, 17
1.3.2 Black Bodies, 18
1.3.3 The Lightening Rod, 19
1.4 Consequences, 20
1.4.1 Accidents/Aging/Neglect, 21
1.4.2 The Report Card, 21
1.4.2.1 The Domino Effect, 22
1.4.3 Terrorism/Extremists, 22
1.4.4 Cyber Exploits/Criminals, 25
1.4.4.1 Black Hats, 25
1.4.4.2 Cybercrime Pays, 26
1.4.5 The Soft War, 27
1.4.6 Cyberattacks and CIKR, 27
1.5 Discussion, 29
References, 29
Before the terrorist attacks of 9/11 infrastructure both critical and otherwise was of interest only to civil engineers,
planners, and a handful of regulators. Afterward, infrastructure became critical and the media began to show interest.
It became even more interesting when global warming and climate change became an acceptable topic at cocktail
parties. Even the politicians fought over it, leading up to the Inflation Reduction Act of 2022, which was essentially a
global warming act. Infrastructure became mainstream.
This chapter provides definitions of CIKR (Critical Infrastructure and Key Resources), threat, vulnerability, consequence,
risk, resilience, and sustainability. In addition, it identifies the challenges due to vastness, political willpower, NIMBY
Critical Infrastructure Resilience and Sustainability Reader, First Edition. Ted G. Lewis.
© 2024 John Wiley & Sons, Inc. Published 2024 by John Wiley & Sons, Inc.
2 1 The Challenge
(not in my back yard), and the exceptional long-term effort needed to protect and maintain resilience and sustainable
infrastructures. The emphasis is on resilience and sustainability under increasing stress due to climate change, and the
exponentially increasing threat of cyberattacks, although other threats are considered.
CIKR manifests as systems – collections of interacting or connected assets that act according to a set of rules to form a
unified whole. They form a community or industrial commons much like the military-industrial complex of yore. While
the plumbing is real or virtual, CIKR is embedded in a complex collection of public and private organizations with rules
and regulations spelled out in detail.
CIKR systems respond to stresses placed on them by nature and humans. These are qualitatively or quantitatively spelled
out in terms of risk, resilience, and sustainability:
●● Risk: expected loss due to a CIKR fault or system failure.
●● Resilience: the ability of a CIKR system to resist, absorb, adapt, and recover from a fault or system failure under stress.
●● Sustainability: the ability to maintain or support a process continuously over time.
We start with a history lesson: how did critical infrastructure begin and evolve into a major responsibility of government?
Then we identify the major threats and consequences confronting infrastructures in America. The focus is on climate
change, the prominent challenge of the twenty-first century, followed by cybersecurity.
At the top of the list of threats is extreme weather due to climate change, because it threatens civilization as well as CIKR
across the globe. Secondary threats are cyberattacks, accidents/neglect/aging, and terrorists. These are the four horsemen
of CIKR sustainability and resilience.
1.1 The Evolution of Critical Infrastructure Protection
CIKR (Critical Infrastructure and Key Resources) systems are considered critical because of their importance to modern
life. They could just as well be defined as essential because without them, civilization as we know it is not possible. Modern
society is dependent on roads, bridges, communication systems, food production and delivery, drinking water and waste-
water management, energy and power, transportation, medical and emergency services, etc. Without them, society would
devolve back to a more primitive state.
CIKR systems have evolved over a long period of time, accelerating in sophistication with technology. But the definition
of CIKR, along with the realization of its importance and fragility, reaches back to World War II and the Korean conflict,
when the United States realized that fuels used to power transportation was a critical asset. Without gasoline and oil, the
United States would have been unable to fight.
The criticality of CIKR systems after WWII was soon forgotten until the terrorist attacks leading up to 9/11. The trauma of
9/11 led to the development of plans and procedures for protecting CIKR from accidents, terrorists, cybercriminals, and climate
change. As the threat evolves, so does the doctrine of protection in homeland security. The following is a brief introduction and
description of this evolution.
1.1.1 In the Beginning

In 1942, the United States was in deep trouble. With the Japanese attack on Pearl Harbor came the prospect of an energy
supply shortage. In particular, petroleum products such as gasoline were about to run low or even run out. This prompted
the Petroleum Administration for War to create the Petroleum Administration for Defense Districts, aka PADDs – Executive
Order 9276 – “to assure for the prosecution of the war the conservation and most effective development and utilization of
petroleum in the United States and its territories and possessions.”1 This was better known as “gas rationing,” because, to
some people, it meant going without gasoline.
The reaction was interesting: some people turned to walking, bicycling, and simply staying at home. A few turned to
inventing electric bicycles. One worker borrowed a 12-V battery from a car and an electric motor from a washing machine,
put them in his bicycle, and rode to work in what was perhaps the first electric bike.
1 https://www.presidency.ucsb.edu/documents/executive-order-9276-establishing-the-petroleum-administration-for-war.
1.1 The Evolution of Critical Infrastructure Protectio 3
Creation of PADDs was the first attempt at critical infrastructure protection in homeland security by the United States.
Conservation of gasoline and oil in the face of Nazi attacks on oil tankers in the Atlantic meant producing more in PADD
3 and consuming less in the other PADDs. PADDs have been with Americans ever since.
EO-9276 divided the country into five districts:
PADD 1:
A. New England states
B. Central Atlantic states
C. Lower Atlantic states
PADD 2: Midwest states
PADD 3: Gulf Coast states
PADD 4: Rocky Mountain states
PADD 5: West Coast, Alaska, and Hawaiian Island states
Most of the domestic oil came from PADD 3, and refined products like gasoline came from PADD 2. PADD 1 was then,
and still is, the largest consumer of oil products. PADDs were no longer needed at the end of WWII, but they were revived
again in 1950 because of the Korean War. Eventually, two more PADDs – 6 and 7 – were added, but by 1954, the Petroleum
Administration for War was abolished, and along with it, the need for PADDs! So, why are they still used?
Paragraph (e) states an additional purpose that is still with us today:
Compile data and make continuing surveys with respect to the effect of the prices charged for petroleum upon the
efficient wartime operations of the petroleum industry and the maintenance of adequate supplies of petroleum for
war and essential industrial and civilian uses. On the basis of such surveys, the Petroleum Administrator shall
consult with and recommend to the Administrator, Office of Price Administration, such upward or downward
adjustments in the schedule of prices charged for petroleum as will, in the judgment of the Petroleum Administrator,
assure the efficient wartime operation of the petroleum industry and the maintenance of adequate supplies of
petroleum for war, and essential industrial and civilian uses. In order to enable the Petroleum Administrator to
make appropriate recommendations, the Price Administrator shall advise with the Petroleum Administrator prior
to the establishment or alteration by the Price Administrator of any schedule of prices to be charged for petroleum.
Recognition of the energy sector of the US economy as critical faded as gasoline shortages abated. Americans went about
their business as usual until the second major event in the history of critical infrastructure occurred2:
In October [1962], President John F. Kennedy, on national television, revealed that the Soviets had placed nuclear
missiles in Cuba. As a result of this aggressive action, he ordered quarantine on all offensive military equipment
under shipment to Cuba until the Soviets removed their weapons . . . . For nearly a week, the Nation was transfixed
by the actions of Soviet Premier Nikita Khrushchev and President Kennedy. During this time, ineffective communica-
tions were hampering the efforts of the leaders to reach a compromise. Without the ability to share critical informa-
tion with each other using fax, e-mail, or secure telephones such as we have today, Premier Khrushchev and President
Kennedy negotiated through written letters. Generally, Washington and Moscow cabled these letters via their embas-
sies. As the crisis continued, hours passed between the time one world leader wrote a letter and the other received it.
Tensions heightened. On October 27 and 28, when urgency in communications became paramount, Premier
Khrushchev bypassed the standard communication channels and broadcast his letters over Radio Moscow.
Following the crisis, President Kennedy, acting on a National Security Council recommendation, signed a
Presidential memorandum establishing the NCS. The new system’s objective was “to provide necessary communica-
tions for the Federal Government under all conditions ranging from a normal situation to national emergencies and
international crises, including nuclear attack.”
At its inception on August 21, 1963, the NCS was a planning forum composed of six Federal agencies. Thirty-five
years later, it is a vital institution comprising 23 member organizations that ensure NS/EP (National Security/
Emergency Preparedness) telecommunications across a wide spectrum of crises and emergencies. … During the
1980s and 1990s, the NCS expanded its focus to develop Government wide NS/EP procedures and enhancements to
the Nation’s public networks and information infrastructures.
2 http://www.ncs.gov/about.html.
4 1 The Challenge
The role of the communications infrastructure grew more important as the United States entered the information age. In
1978, two communication regulatory agencies (Department of Commerce Office of Telecommunications and the
Whitehouse Office of Telecommunications) were combined into the National Telecommunications and Information
Administration (NTIA) by Executive Order 12046. NTIA handled the process of selling spectrum to telephone, radio, and
TV networks. It also has the distinction of being the federal agency that oversaw the commercialization of the Internet in
1998–1999. The National Communications System (NCS) was formally assigned responsibility for the telecommunications
infrastructure in 1984 by Executive Order 12472.
In 1982, President Reagan established the National Security Telecommunications Advisory Committee (NSTAC) by
Executive Order 12382. This important Presidential advisory body is made up of the CEOs of major telecommunications
companies. NSTAC is perhaps the first organization to advise a President on critical infrastructure protection.
The Petroleum Administration, NCS, and NSTAC were the first critical infrastructure agencies within the US government.
Twenty years would pass before the term critical infrastructure was defined and the entire US population became aware of
its importance in their daily lives. The Department of Homeland Security (DHS) absorbed NCS in February 2003, but the
NSTAC still reports to the President of the United States.
1.1.2 Natural Disaster Recovery

While the NCS and NSTAC were active throughout the 1970s and 1980s, disaster response – both human-caused and
natural – was still on the back burner as far as critical infrastructure protection was concerned. The Federal Emergency
Management Agency (FEMA) was created in 1978–1979 to respond to hurricanes and earthquakes.3 Soon after its creation,
FEMA was assigned the (temporary) responsibility of responding to terrorist attacks by Executive Order 12148 in 19794:
All functions vested in the President that have been delegated or assigned to the Defense Civil Preparedness Agency,
Department of Defense, are transferred or reassigned to the Director of the Federal Emergency Management Agency.
All functions vested in the President that have been delegated or assigned to the Federal Disaster Assistance
Administration, Department of Housing and Urban Development, are transferred or reassigned to the Director of
the Federal Emergency Management Agency, including any of those functions re-delegated or reassigned to the
Department of Commerce with respect to assistance to communities in the development of readiness plans for
severe weather-related emergencies.
All functions vested in the President that have been delegated or assigned to the Federal Preparedness Agency,
General Services Administration, are transferred or reassigned to the Director of the Federal Emergency
Management Agency.
All functions vested in the President by the Earthquake Hazards Reduction Act of 1977 (42 U.S.C. 7701 et seq.),
including those functions performed by the Office of Science and Technology Policy, are delegated, transferred, or
reassigned to the Director of the Federal Emergency Management Agency . . . . For purposes of this Order, “civil emer-
gency” means any accidental, natural, man-caused, or wartime emergency or threat thereof, which causes or may cause
substantial injury or harm to the population or substantial damage to or loss of property.
FEMA was confronted by perhaps the first major terrorist attack on US soil in Oregon in 1984. Members of the politico-
religious commune founded by Bhagwan Shree Rajneesh5 attempted to influence a political election by poisoning voters
with salmonella.6
In a bizarre plot to take over local government, followers of Bhagwan Shree Rajneesh poisoned salad bars in 10 res-
taurants in The Dalles in 1984, sickening 751 people with salmonella bacteria. Forty-five of whom were hospitalized.
3 Presidential Reorganization Plan No. 3 issued by President Carter in 1978 established the Federal Emergency Management Agency (FEMA),
which went into effect on 1 April 1979.
4 http://www.archives.gov/federal_register/codification/executive_order/12148.html.
5 http://www.religioustolerance.org/rajneesh.htm.
6 “The group settled on the 65,000 acre ‘Big Muddy Ranch’ near Antelope, Oregon, which his sannyasins had bought for six million dollars. The ranch
was renamed Rajneeshpuram (‘Essence of Rajneesh’). This ‘small, desolate valley twelve miles from Antelope, Oregon was transformed into a thriving
town of 3,000 residents, with a 4,500 foot paved airstrip, a 44 acre reservoir, an 88,000 square foot meeting hall…’ ” http://www.clui.org/clui_4_1/lotl/
lotlv10/rajneesh.html.
It is still the largest germ warfare attack in U.S. history. The cult reproduced the salmonella strain and slipped it into
salad dressings, fruits, vegetables, and coffee creamers at the restaurants. They also were suspected of trying to kill
a Wasco County executive by spiking his water with a mysterious substance. Later, Jefferson County District Attorney
Michael Sullivan also became ill after leaving a cup of coffee unattended while Rajneeshees lurked around the
courthouse. Eventually, Ma Anand Sheela, personal secretary of the Bhagwan, was accused of attempted murder,
conspiracy, arson, and other crimes and disowned by the Bhagwan. Convicted of the charges against her, she spent
29 months in federal prison, then moved to Switzerland.7
The salmonella incident in Oregon was an attack on one of the many infrastructure sectors identified as critical over the
past decade: Agriculture. But in 1984 there was no generally accepted definition of infrastructure, nor any recognition of
what sectors belonged to the list of national critical infrastructures.
The importance of infrastructure began to dawn on the federal government when in 1988 President Reagan issued
Executive Order 12656. This order alludes to “essential resources” and places responsibility for their protection in the
hands of federal departments:
The head of each Federal department and agency, within assigned areas of responsibility shall:
Sec. 204. Protection of Essential Resources and Facilities.
1) Identify facilities and resources, both government and private, essential to the national defense and national
welfare, and assess their vulnerabilities and develop strategies, plans, and programs to provide for the security of
such facilities and resources, and to avoid or minimize disruptions of essential services during any national secu-
rity emergency;
2) Participate in interagency activities to assess the relative importance of various facilities and resources to essen-
tial military and civilian needs and to integrate preparedness and response strategies and procedures;
3) Maintain a capability to assess promptly the effect of attack and other disruptions during national security
emergencies.
This executive order contains a number of objectives that remain problematic even today. It calls for identification of
public and private facilities that are essential to national welfare – a task that remains unfulfilled today, as political and
socioeconomic forces complicate the definition of “essential” and “national welfare.” A bridge in one county may be con-
sidered essential by voters in that county, but not essential in an objective sense, because of alternative routes. Moreover,
when limited resources are considered and there is funding for only one bridge, objective selection of which bridge is saved
or repaired quickly enters the political realm instead of the rational realm.
Part two of President Reagan’s executive order calls for interagency cooperation to address military and civilian needs.
When a severe emergency such as a devastating superstorm or terrorist attack happens, however, interagency cooperation
often vanishes, and the military takes over. Civil-military relations theoretically mean that the military takes orders from
civilians, but in practice, only the military has the capacity to deal with major catastrophes. This inequality between the
authority of local law enforcement agencies and the readiness of federal troops is revealed over and over again whenever
major incidents such as Hurricane Katrina and New Orleans spin out of control.
Finally, the third part of the executive order remains problematic because state and local agencies often do not or cannot
afford to maintain capabilities to meet the need. For example, a smallpox outbreak in Manhattan – population eight
million – would quickly overwhelm public health and safety agencies in New York. The state and local authorities would
have to maintain 40,000 trained emergency responders to head off the spread of smallpox. Forest fires in California quickly
overwhelmed firefighters in 2018 and illustrated the importance of interagency and interregional (reciprocal) response
agreements in the Department of Interior.
1.1.3 What Is Critical?

Even in the early 1990s, the trend toward greater awareness of human-made and natural disasters was subtle – it had not
reached a point where it was of national concern. But by 1993–1995, the rate and severity of acts of terror, for example, were
7 https://www.grunge.com/355888/the-story-behind-the-largest-bioterrorist-attack-in-u-s-history.
6 1 The Challenge
increasing and becoming more alarming to the federal government. The 1993 attack on the World Trade Center led by
Ramzi Yousef, the acts and eventual capture of the Unabomber (1995), the devastating attack on the Federal Building in
Oklahoma City, Oklahoma (1995), and the Sarin gas attack in a Tokyo subway in 1995, suggested a trend. Acts of violence
by nongovernmental organizations (NGOs) were increasing, and as a byproduct, raising the level of public awareness. Soon
these acts would be attributed to terrorists and move from the back to the front page of the media. Within a short period of
5–6 years, response to unlawful terrorism would become known as the Global War on Terrorism (GWOT) and reached a
threshold that deserved national attention.
The importance of infrastructure for the safety and security of the US population began to take shape. But the threat was
still confined to human-initiated acts of terror. One of the earliest concerns was the fragility and vulnerability of the sys-
tems we depend on daily, such as roads, bridges, stadiums, schools, shopping malls, and office buildings. These facilities
accommodate many people and yet they are completely open and unprotected. The communication systems, health care,
energy, and power systems that run cities and enable modern society to function were also open and unprotected. The
emergency response systems and public health services taken for granted for decades were suddenly exposed as poorly
prepared. Modern life depended on them, and yet, these essential systems were vulnerable to attacks by both humans and
Mother Nature.
The modern origin of homeland security, and one of its pillars, critical infrastructure protection, can be placed some-
where between 1993 and late 1995. In fact, 1995 is a reasonable start date because of the flurry of activity aimed at protect-
ing national infrastructure and key assets (CIKR) after 1995. Presidential Decision Directive 39 (PDD-39) issued by
President Clinton in 1995 set the stage for what was to come – a new Federal Department of Homeland Security. PDD-39
essentially declared war on terrorists8:
It is the policy of the United States to deter, defeat and respond vigorously to all terrorist attacks on our territory
and against our citizens, or facilities, whether they occur domestically, in international waters or airspace or on
foreign territory. The United States regards all such terrorism as a potential threat to national security as well as
a criminal act and will apply all appropriate means to combat it. In doing so, the U.S. shall pursue vigorously
efforts to deter and preempt, apprehend and prosecute, or assist other governments tov prosecute, individuals
who perpetrate or plan to perpetrate such attacks.
We shall work closely with friendly governments in carrying out our counterterrorism policy and will support
Allied and friendly governments in combating terrorist threats against them. Furthermore, the United States shall
seek to identify groups or states that sponsor or support such terrorists, isolate them and extract a heavy price for
their actions. It is the policy of the United States not to make concessions to terrorists.
The criticality of national infrastructure and associated key assets became an important issue when President Clinton
issued executive order EO-13010 in 1996. This executive order established a Presidential Commission on Critical
Infrastructure Protection (PCCIP). The commission was chaired by Robert Marsh, and subsequently became known as the
Marsh Report [1]. It defined critical infrastructure in terms of “energy, banking and finance, transportation, vital human
services, and telecommunications.” The Marsh Report was the first publication to use the term critical infrastructure and
has become one of the foundational documents of critical infrastructure protection.
The Marsh Report and executive order EO-13010 provided the first formal definition of infrastructure as “a network
of independent, mostly privately-owned, man-made systems that function collaboratively and synergistically to pro-
duce and distribute a continuous flow of essential goods and services.” And critical infrastructure is, “an infrastructure
so vital that its incapacity or destruction would have a debilitating impact on our defense and national security.”
According to Executive Order 130109:
Certain national infrastructures are so vital that their incapacity or destruction would have a debilitating impact
on the defense or economic security of the United States. These critical infrastructures include telecommunica-
tions, electrical power systems, gas and oil storage and transportation, banking and finance, transportation, water
supply systems, emergency services (including medical, police, fire, and rescue), and continuity of government.
Threats to these critical infrastructures fall into two categories: physical threats to tangible property (“physical
8 http://www.fas.org/irp/offdocs/pdd39.htm.
9 http://www.fas.org/irp/offdocs/eo13010.htm.
threats”), and threats of electronic, radio frequency, or computer-based attacks on the information or
communications components that control critical infrastructures (“cyber threats”). Because many of these critical
infrastructures are owned and operated by the private sector, it is essential that the government and private sector
work together to develop a strategy for protecting them and assuring their continued operation.
The work of the PCCIP resulted in PDD-63 (Presidential Decision Directive of 1998), which defined critical infrastruc-
ture more specifically and identified basic sectors of CIKR. According to PDD-63:
Critical infrastructures are those physical and cyber-based systems essential to the minimum operations of the
economy and government. They include, but are not limited to, telecommunications, energy, banking and finance,
transportation, water systems and emergency services, both governmental and private.10
The definition of critical infrastructure in PDD-63 went through rapid evolution and expansion after the attacks of 9/11.
The office of the President of the United States released the National Strategy for Homeland Security in July 2002 and then
rapidly followed up with an expansion of the definition of critical infrastructure sectors in February 2003 with the release of
The National Strategy for the Physical Protection of Critical Infrastructures and Key Assets [2].
According to the 2003 strategy document, the objectives of CIKR protection include:
●● Identifying and assuring the protection of those infrastructures and assets that we deem most critical in terms of national-
level public health and safety, governance, economic and national security, and public confidence consequences;
●● Providing timely warning and assuring the protection of those infrastructures and assets that face a specific, imminent
threat; and
●● Assuring the protection of other infrastructures and assets that may become terrorist targets over time by pursuing spe-
cific initiatives and enabling a collaborative environment in which federal, state, and local governments and the private
sector can better protect the infrastructures and assets they control.
In addition, the 2003 National Strategy lists five key resources (KR):
●● National Monuments and Icons
●● Nuclear Power Plants
●● Dams
●● Government Facilities
●● Commercial Key Assets
1998 was a year of ramping up counterterrorism programs. Major initiatives besides PDD-62 (Countering Terrorism),
PDD-63 (Critical Infrastructure Protection), and PDD-67 (Continuity of Government) were the creation of a variety of
programs:
●● National Infrastructure Protection Center established in the Department of Justice
●● Chemical Safety Board formed
●● National Domestic Preparedness Office created in Department of Justice
●● Critical Infrastructure Analysis Office (CIAO) established
●● Counterterror Coordination Unit in National Security Council formed
●● Congress earmarks $17 M for Special Equipment and Training Grants
●● Attorney General announces creation of National Domestic Prep. Office (NDPO)
1.1.4 Public–Private Cooperation

By 1999 some experts believed that most infrastructure in the United States was owned by the private sector – not
government. The Internet was commercialized in 1998, and the Communications and Electrical Power sectors were in the
process of being deregulated. Control of most public utilities was in the hands of corporations. It appeared that the private
10 http://www.fas.org/irp/offdocs/pdd/pdd-63.htm.
8 1 The Challenge
sector owned or operated most infrastructure considered “critical.”11 Thus, in 1999 President Clinton established NIAC
(National Infrastructure Assurance Council) to bring industry and government closer together. According to Executive
Order 13130, NIAC was established to facilitate the partnership through PS-ISAC (Public Sector Information Sharing and
Analysis Centers)12:
By the authority vested in me as President by the Constitution and the laws of the United States of America, includ-
ing the Federal Advisory Committee Act, as amended (5 U.S.C. App.), and in order to support a coordinated effort
by both government and private sector entities to address threats to our Nation’s critical infrastructure, it is hereby
ordered as follows:
Section 1. Establishment.
a) There is established the National Infrastructure Assurance Council (NIAC). The NIAC shall be composed of not
more than 30 members appointed by the President. The members of the NIAC shall be selected from the private
sector, including private sector entities representing the critical infrastructures identified in Executive Order 13010,
and from State and local government. The members of the NIAC shall have expertise relevant to the functions of
the NIAC and shall not be full-time officials or employees of the executive branch of the Federal Government.
b) The President shall designate a Chairperson and Vice-Chairperson from among the members of the NIAC.
c) The National Coordinator for Security, Infrastructure Protection and Counter-Terrorism at the National Security
Council (National Coordinator) will serve as the Executive Director of the NIAC.
d) The Senior Director for Critical Infrastructure Protection at the National Security Council will serve as the
NIAC’s liaison to other agencies.
e) Individuals appointed by the President will serve for a period of 2 years. Service shall be limited to no more than
3 consecutive terms.
Section 2. Functions.
a) The NIAC will meet periodically to:
1) enhance the partnership of the public and private sectors in protecting our critical infrastructure and provide
reports on this issue to the President as appropriate;
2) propose and develop ways to encourage private industry to perform periodic risk assessments of critical pro-
cesses, including information and telecommunications systems; and
3) monitor the development of Private Sector Information Sharing and Analysis Centers (PS-ISACs) and provide
recommendations to the National Coordinator and the National Economic Council on how these organizations
can best foster improved cooperation among the PS-ISACs, the National Infrastructure Protection Center
(NIPC), and other Federal Government entities.
b) The NIAC will report to the President through the Assistant to the President for National Security Affairs, who
shall assure appropriate coordination with the Assistant to the President for Economic Policy.
c) The NIAC will advise the lead agencies with critical infrastructure responsibilities, sector coordinators, the
NIPC, the PS-ISACs and the National Coordinator on the subjects of the NIAC’s function in whatever manner
the Chair of the NIAC, the National Coordinator, and the head of the affected entity deem appropriate.
1.1.5 Federalism: Whole of Government

The National Strategy document of 2003 declares that homeland security, and CIKR in particular, are “whole of government”
responsibilities. “Homeland security, particularly in the context of critical infrastructure and key asset protection, is a
shared responsibility that cannot be accomplished by the federal government alone. It requires coordinated action on the
part of federal, state, local, and tribal governments; the private sector; and concerned citizens across the country.”13
But in practice, the strategy places most of the power – and all of the funding – in the hands of the federal government.
For example, all responsible agencies are federal government agencies instead of state, local, or tribal agencies. The federal
government assumed this responsibility even before the creation of the DHS in 2003. The President’s Critical Infrastructure
11 The source of this claim has never been found, but a popular meme of the time was that the private sector owned or operated 85% of the
critical infrastructure in the United States.
12 http://www.archives.gov/federal_register/executive_orders/1999.html#13130.
Protection Board (PCIPB) was one of the earliest federal government agencies created as a consequence of 9/11. It was fol-
lowed by a flurry of additional government bureaucracies created to counter terrorism and natural disasters – incidents
that appeared to be rising exponentially.
By Executive Order 13231 (October 2001), President Bush created the President’s Critical Infrastructure Protection Board
(PCIPB), with primary responsibility to develop policies to protect the information infrastructure of the federal govern-
ment. EO-13231 recognized the growing importance of telecommunications and Internet infrastructure as well as its inter-
dependency with other sectors. Without information systems, the US Federal Government could not continue to operate
in the event of an attack:
Consistent with the responsibilities noted in section 4 of this order, the Board shall recommend policies and
coordinate programs for protecting information systems for critical infrastructure, including emergency preparedness
communications, and the physical assets that support such systems.
In 2002 President Bush signed the Homeland Security Bill, establishing the new DHS. It began operation in February
2003 and incorporated 22 agencies that were scattered throughout the federal bureaucracy. This included the NCS, CIAO,
and Department of Justice Office of Domestic Preparedness, along with a number of other large agencies such as the TSA,
INS, Border Patrol, and Coast Guard. Protection of critical infrastructure continued to expand and become one of the major
responsibilities of the DHS.
Presidential directive HSPD-5 (February 2003) and its companion, HSPD-8 (December 2003) authorized the Secretary of
DHS, “to prevent, prepare for, respond to, and recover from terrorist attacks, major disasters, and other emergencies.”13 In
December 2003 President Bush replaced PDD-63 with HSPD-7 (Homeland Security Presidential Directive #7). It rewrote
the list of sectors and sector-specific agencies responsible.
HSPD-7 does not specify who is responsible for several of the sectors previously identified as “critical.” It appears that
HSPD-7 was written to address in-fighting among departments and agencies that may have felt left out of the National
Strategy. Alternatively, the purpose of HSPD-7 may have been to include departments and agencies that have expertise in
fields such as cyber, chemical, and nuclear security. For whatever reason, HSPD-7 leaves some responsibilities unspecified
and spreads others across multiple departments.
For the first time, HSPD-7 declared that it is impractical to protect everything and focused effort on major incidents –
ones that cause mass casualties comparable to the effects of using weapons of mass destruction:
While it is not possible to protect or eliminate the vulnerability of all critical infrastructure and key resources
throughout the country, strategic improvements in security can make it more difficult for attacks to succeed and can
lessen the impact of attacks that may occur. In addition to strategic security enhancements, tactical security improve-
ments can be rapidly implemented to deter, mitigate, or neutralize potential attacks … Consistent with this directive,
the [DHS] Secretary will identify, prioritize, and coordinate the protection of critical infrastructure and key resources
with an emphasis on critical infrastructure and key resources that could be exploited to cause catastrophic health
effects or mass casualties comparable to those from the use of a weapon of mass destruction. [3]
By 2009, the number of sectors and KR had expanded even more, culminating in 18 CIKR: critical manufacturing was
added, and Information Technology and Communications were separated into two sectors.14 In less than a decade, the
number of CIKR expanded from 8 to 18. At this pace, CIKR would embrace just about every aspect of society, from
communications, power, and health care, to the food we eat, water we drink, and work we do. If CIKR embraces nearly
everything, perhaps it means nothing. What then is the main goal of CIP?
HSPD-5/HSPD-8 were expanded by President Obama on 30 March 2011, to strengthen, “… the security and resilience of
the United States through systematic preparation for the threats that pose the greatest risk to the security of the Nation,
including acts of terrorism, cyberattacks, pandemics, and catastrophic natural disasters.”15 President Obama pared down
the number of CIKR in HSPD-7 to 16 sectors and key resources in PPD-21 (2013), see Table 1.1. Postal and shipping was
folded into Transportation and National Monuments and Icons was removed. In addition, the sector-specific agencies
13 HSPD-5 (2003).
14 National Infrastructure Protection Plan (NIPP): Partnering to enhance protection and resiliency, 2009.
15 PPD-8 (2011).
10 1 The Challenge
Table 1.1 CIKR as defined by PPD-21 (2013).
Sector Sector-specific agency
Chemical Department of Homeland Security

Commercial facilities Department of Homeland Security
Communications Department of Homeland Security
Critical manufacturing Department of Homeland Security
Dams Department of Homeland Security
Defense industrial base Department of Defense
Emergency services Department of Homeland Security
Energy Department of Energy
Financial services Department of the Treasury
Food and agriculture U.S. Department of Agriculture and Department of
Health and Human Services
Government facilities Department of Homeland Security and General Services
Administration
Health care and public health Department of Health and Human services
Information technology Department of Homeland Security
Nuclear reactors, materials, and waste Department of Homeland Security
Transportation systems Department of Homeland Security and Department of
Transportation
Water and wastewater systems Environmental Protection Agency
responsible for each CIKR were sharpened with more authority given to the DHS. Thus, the long-term definition of critical
infrastructure was established, but it emphasized physical assets more than cyber assets. This changed in 2018.
A series of events precipitated a major re-alignment within DHS in late 2018. Major information security breaches of
NSA (National Security Agency) documents by Edward Snowden in 2013, followed by Wiki leaks releasing emails and
documents exfiltrated from the Democratic National Committee during the 2016 US Presidential election campaign,
and misinformation campaigns waged by the Russian Internet Research Agency attempting to influence the 2016 US
Presidential election precipitated a renewed focus on cyber as well as physical security within the DHS. The 2018 CISA
legislation created the CISA organization.
On 16 November 2018, President Trump signed into law the Cybersecurity and Infrastructure Security Agency Act of 2018
(CISA). This legislation emphasized cybersecurity for the first time and replaced the National Protection and Programs
Directorate (NPPD) with the Cybersecurity and Infrastructure Security Agency also referred to as CISA.
CISA’s Cybersecurity Division works with government and private sector customers to ensure the security and resilience
of the nation’s cyber infrastructure. The division includes the National Cybersecurity Communications Integration
Center (NCCIC).
The Emergency Communications Division enhances public safety interoperable communications at all levels of
government, providing training, coordination, tools, and guidance to help partners across the country develop their
emergency communications capabilities.
The Infrastructure Security Division coordinates security and resilience efforts using trusted partnerships across the
private and public sectors and delivers training, technical assistance, and assessments to federal stakeholders as well as
to infrastructure owners and operators nationwide.
The National Risk Management Center (NRMC) works to identify and address the most significant risks to our nation’s
critical infrastructure.
The CISA leads the national effort to defend critical infrastructure against the threats of today while working with
partners across all levels of government and in the private sector to secure against the evolving risks of tomorrow.
1.2 Defining CIKR Risk and Resilienc 11
1.2 Defining CIKR Risk and Resilience
A number of competing and sometimes overlapping frameworks exist for organizing efforts to protect critical infrastruc-
ture systems. These frameworks can be roughly categorized as political, qualitative, quantitative, and regulatory/
legal. It is important to note that other frameworks exist in both theory and practice. Frameworks are used as a lens
through which the practitioner views his or her job.
Political frameworks have existed since the beginning of government’s recognition of CIKR as a federal, state, local, and
tribal responsibility. For example, the first allocation of resources formula to combat terrorist attacks on CIKR was based
on a mix of population and politics. Each region was allocated funding regardless of the need. Emergency response facili-
ties such as firefighting equipment were funded regardless of risk or the likelihood of threats. Politically, this made sense,
because large population centers are where the voters are. However, the embarrassing reality is that some of the most
critical assets such as the largest nuclear power plant in the nation are located far from population centers. Threats are
more likely to be high where critical infrastructure assets are high valued or high impact, regardless of population or risk.
Qualitative frameworks such as the National Institute of Standards and Technology (NIST) cybersecurity framework
began to appear as checklists and recommendations to owners and operators of industrial control systems, power grids,
and water system Supervisory Control and Data Acquisition (SCADA). Executive order EO-13636, Improving Critical
Infrastructure Cybersecurity (February 2013) and the Cybersecurity Enhancement Act of 2014 (CEA) established the role of
the NIST in identifying and developing cybersecurity risk frameworks (CSF) for use by critical infrastructure owners and
operators. NIST claims the CSF is, “a prioritized, flexible, repeatable, performance-based, and cost-effective approach,
including information security measures and controls that may be voluntarily adopted by owners and operators of critical
infrastructure to help them identify, assess, and manage cyber risks.”
Version 1.1 (April 2018) of the CSF prescribes a five-step process along with checklists of recommended practices:
1) Identify: Develop an organizational understanding to manage cybersecurity risk to systems, people, assets, data, and
capabilities. Understanding the business context, the resources that support critical functions, and the related cyberse-
curity risks enables an organization to focus and prioritize its efforts, consistent with its risk management strategy and
business needs.
2) Protect: Develop and implement appropriate safeguards to ensure delivery of critical services. This step supports the
ability to limit or contain the impact of a potential cybersecurity event.
3) Detect: Develop and implement appropriate activities to identify the occurrence of a cybersecurity event.
4) Respond: Support the ability to contain the impact of a potential cybersecurity incident.
5) Recover: Develop and implement appropriate activities to maintain plans for resilience and to restore any capabilities
or services that were impaired due to a cybersecurity incident.
The framework is a hierarchical checklist for computer system owners and operators. For example, the Protect step
might be further decomposed into sub-steps:
User credential verification, revocation, and device authorization
Physical access permissions
Remote access permissions
Network configuration and integrity
Personnel awareness and training
Data security – at rest and in transit
Data capacity assurance
Separation of development systems from operational systems
Configuration change controls
Backup maintenance
Response and recovery plans are tested
Vulnerability management plan in place
Audit records implemented and maintained
Removable media is protected
Communications and control networks are protected
Failsafe, load-balancing mechanisms implemented for resilience
12 1 The Challenge
While NIST claims CSF is a risk-based approach to managing cybersecurity risk, the framework does not define risk or
resilience and offers no specific risk assessment methodology or model. Users are left to their own definition of risk and
resilience, which is often qualitative rather than quantitative.
Quantitative frameworks – the use of formulas and equations to quantify risk and resilience – have become known as
risk-informed decision-making within DHS. This is a rigorous and disciplined approach that assigns numbers to assets rep-
resenting probabilities and consequences. For example, the USCG MSRAM quantifies risk in terms of threat probability,
vulnerability probability, and consequence or cost due to damage. This rigorous approach assigns numbers to each attack
scenario on a port, and then ranks them for the purpose of funding improvements.
Regulatory/legal frameworks follow a similar process. However, for most of its history, DHS has deferred to other agen-
cies when it comes to tying CIKR security to regulations and legal requirements. Generally, regulation has been applied
more to safety and environmental protections than security. However, this remains a largely untapped potential source of
CIKR protection. For example, the vulnerability of the communications sector is heavily dependent on regulation and the
1996 Telecommunications Act, which created the highly critical carrier hotels and concentrated assets vulnerable to both
physical and cyberattacks.
1.2.1 Risk Strategy

The purpose of a risk strategy is to allocate resources optimally, according to some criterion. Specifically, infrastructure is
too vast, complex, and expensive to protect everything, and expertise among sector-specific agencies is generally nonexist-
ent. This called for a narrower definition of objectives and operational definitions of goals, e.g. government had to define
what is critical in a critical infrastructure, and both public and private parties had to agree upon metrics for prioritizing
projects. Before a CIKR policy can be implemented, goals and objectives must be defined rigorously enough to imple-
ment them.
Policy stated the obvious – protect infrastructure from hazards such as terrorists, storms, and earthquakes. Protection
included both hardening and response when something bad happens. Funding is inadequate to protect everything, so
implementation depended on prioritization of critical infrastructure assets, which in turn depended on the definition of
criticality.
Two approaches were initially attempted. The first prioritization strategy was called risk-informed and the second was
called resilience-informed. Risk-informed decision-making means applying risk assessments to prioritize funding of pro-
jects to harden critical infrastructure assets. Resilience-informed decision-making means applying various methods to
enhance the resilience of infrastructure assets. Rather than hardening assets, resilience-informed decision-making attempts
to make assets adaptable and anti-fragile. Both approaches have their strengths and weaknesses.
The fundamental question posed by a risk-informed strategy is this: given limited resources of the federal government,
how should resources (funding) be allocated to reduce risk? How should priorities be set? Once again, we turn to the DHS
for definitions and guidance:
Threat/hazard: A human attack poses a threat while a weather event poses a hazard. Both terms are used to describe some-
thing that can harm CIKR, e.g. a terrorist with a bomb or a hurricane-force wind to power lines.
Vulnerability: A weakness in a CIKR that may be exploited or lead to failure due to a threat or hazard.
Qualitative risk: The potential for an unwanted outcome resulting from threat/hazard – an incident, event, or occurrence, as
determined by its likelihood and the associated consequences.
Quantitative risk: Expected loss, i.e. the probability of a damaging threat/hazard multiplied by its consequences.
Risk-informed decision-making: The determination of a course of action predicated on the assessment of risk, the expected
impact of that course of action on that risk, and other relevant factors.
Risk management framework: A planning methodology that outlines the process for setting goals and objectives; identifying
assets, systems, and networks; assessing risks; prioritizing and implementing protection programs and resiliency strategies;
measuring performance; and taking corrective action.
The era of risk-informed decision-making evolved slowly from politically motivated allocation of resources to the quan-
tifiable and measurable five-step process described above. Instead of dividing funding according to pressures from politi-
cians, risk-informed decision-making allocates funding according to the likelihood and consequence of an event. Risk is
defined in different ways by different sector-specific agencies, but given a rigorous definition of risk, agencies can allocate
funds according to their impact on risk reduction.
1.2.2 Resilience Strategy Normal Collapse Recovery

P0
The vastness of single sectors makes it impossible to pro-
Triangle
tect everything. When multiplied by the large number of Performance
sectors and key assets, the challenge becomes insurmount-
able without some kind of prioritization. Furthermore, Pc
the concept of “100% security” began to vanish and be
replaced by an elusive concept – resilience. Instead of an
unyielding goal of 100% security, resilience was an intan-
Time
gible property of CIKR somewhere between absolute
t0 tr
security and absolute vulnerability. Instead of a secure
infrastructure, a resilient infrastructure was able to bounce Figure 1.1 A resilience triangle is formed by a collapse
back after being attacked or damaged by a storm, earth- followed by gradual recovery.
quake, terrorist attack, cyberattack, etc.
The February 2003 National Strategy document contained the word resilience three times. The NIPP 2009 document
mentions resilience 15 times. The 2013 PPD-21 directive from President Obama incorporates resilience in its title and uses
the word 44 times.16 By 2013, the focus of CIKR had shifted from counterterrorism and all-hazards preparedness to build-
ing resilience in both infrastructure and the population. With the rising awareness of global warming as a major hazard,
resilience and sustainability became a dominant theme. The era of resilient and sustainable infrastructure began, and
terrorism, all-hazards response, and weapons of mass destruction faded into the background.
Even a variety of qualitative definitions of resilience make it difficult to measure and apply. Vurgin et al. surveyed the
concept of resilience in infrastructure systems and offered a number of definitions [4]. Generally, resilience and sustaina-
bility are properties of a system – not a single asset. For example,
Given the occurrence of a particular disruptive event (or set of events), the resilience of a system to that event
(or events) is the ability to efficiently reduce both the magnitude and duration of the deviation from targeted system
performance levels. [4]
This definition is difficult to put into practice because it lacks quantifiable specifics. Bruneau et al. proposed a measura-
ble and operational model of resilience as shown pictorially in Figure 1.1. Damage to a system in the form of magnitude
and duration is represented by a triangular area notched out of the performance-versus-time diagram shown in Figure 1.1.
The resilience triangle represents loss due to a drop in performance followed by a recovery period that eventually restores
the system to its previous level of performance.
The difference between full performance and diminished performance represented by the resilience triangle defines the
system’s resilience. Smaller triangular areas represent greater resilience. The size of the triangular area is reduced by reduc-
ing: (i) recovery time, (ii) precipitous drop in performance, or (iii) both. In addition, the likelihood of a precipitous drop in
performance increases the frequency of collapses over time. Thus, reducing the size of the resilience triangle increases
resilience:
1) Speedup recovery: (tr−t0).
2) Reduce performance drop: (P0−Pc) and.
3) Decrease the probability of failure, V.
This metric quantifies the qualitative definition of resilience proposed in the NIPP 2009:
Resilience: The ability to resist, absorb, recover from, or successfully adapt to adversity or a change in conditions
(pp. 111).
More generally, resilience is the ability of a CIKR system to resist, absorb, adapt, and recover from a fault or
system failure under stress.
16 Presidential Policy Directive-21 – Critical Infrastructure Security and Resilience.

14 1 The Challenge
But the resilience triangle model does not address resistance, absorption, adaptation, and recovery factors loosely defined by the
NIPP. How does a CIKR resist, absorb, or recover from adversity? How is the ability to resist, absorb, or adapt to adversity meas-
ured? These complex properties are addressed by a complex adaptive systems model of CIKR, described in more detail in Chapter 2.
In this book, risk and resilience will be defined in stochastic terms. The probability of a collapse of random size and dura-
tion becomes a problem of statistical analysis. Just as the probability or frequency of hurricanes of an uncertain size are
stochastic events, so is the ability to resist, adapt, and recover. The full story depends on at least a rudimentary understand-
ing of probability and statistics – a topic beyond the scope of this book.
Instead of a rigorous definition of resilience, we opt for defining measures that enhance resilience or processes that
reduce resilience. In general, resilience is a property of CIKR systems rather than single components, buildings, roads, or
computer systems. CIKR systems are stressed by a variety of threats and are plagued by a variety of weaknesses called vul-
nerabilities. These are described in the next chapter.
1.2.3 Sustainability Strategy

Along with increased interest and concern for global warming and its impact on CIKR, the US DHS began emphasizing
sustainability as a goal. Once again, a clear and concise definition is lacking. Qualitatively, sustainability is defined some-
what loosely as:
Sustainability: the ability to maintain or support a process continuously over time.
This simple definition belies the difficulty of building systems that are sustainable for extremely long periods of time.
Automobiles require replacement parts and eventually wear out over 20–30 years. And where can a 30-year replacement
part be found? Sustainability implies a robust support system that defies wear-and-tear, obsolescence, and constantly sup-
plying “infinite” resources.
The 10,000-year clock project initiated by Danny Hillis is an extreme example of the challenge of sustainability.17
According to its website, “[Hillis] wanted to build a clock that ticks once every year and decade, the century hand advances
once every 100 years, and the cuckoo comes out on the millennium. The vision was, and still is, to build a clock that will
keep time for the next 10,000 years.”
Building a durable clock is the least of Hillis’ problems. Where does one obtain replacement parts, say, 1000 years from
now? To be sustainable, the clock must be made of sustainable materials. Hillis favored rust-proof metal and wood. Metal
does not rust or wear out, but it can break. So, Hillis had to accommodate repairing the sustainable clock. Wood is grown
in a nearby forest so that when wooden parts need to be replaced, workmen can chop down a tree. Hillis assumed that
humans will still be around 10,000 years from now!
The clock is located inside a mountain in West Texas to protect it against the weather. An orrery is included – a small physi-
cal model of Earth’s solar system. At the time of this writing, the clock has not been started on its 10,000-year journey.
Carved into the mountain are five room-sized anniversary chambers: 1-year, 10-year, 100-year, 1,000-year, and
10,000-year anniversaries. The one-year anniversary chamber is a special orrery. In addition to the planets and the
Earth’s moon, it includes the interplanetary probes launched during the 20th century. The Clock will activate and
run the orrery once a year on a pre-determined date at solar noon.
The 10,000-year clock is a good example of sustainability. However, CIKR is not designed to last 10,000 years, but perhaps
it should last hundreds of years.
The 10,000-year clock is an extreme illustration of sustainability, and yet it does not get to the heart of the matter. To more
fully understand sustainability, we need to consider thermodynamics – the study of energy and energy transformation in a
working system. An adiabatic process occurs without transferring heat or mass between the system and its surroundings.
That is, it is closed. All systems are either adiabatic or diabatic, meaning there is a loss of mass or energy during operation.
Diabatic systems typically discard energy in the form of heat or light.
In general, CIKR are open diabatic systems with loss, while only a few Earth processes approximate the adiabatic ideal.
How might diabatic systems be constructed to approximate the adiabatic ideal? This is the challenge of sustainability
because an adiabatic system can theoretically run forever without wearing out or running down.
17 https://www.10000yearclock.net/learnmore.html
A circular economy is one that attempts to achieve adiabatic perfection. It is called circular because products of a circular
economy are recycled. Recycling consumes more energy, of course, so circular economies are approximations of adiabatic
systems that preserve energy and mass – an unrealistic goal. Instead, a circular economy attempts sustainability by recy-
cling and/or reusing mass and energy.
Contemporary examples of circular economies, i.e. sustainability – are cogeneration (the production of electricity using
waste heat from an industrial process or the use of steam from electric power generation as a source of heat), regenerative
braking in an electric car, and recycling of household garbage. Recycling solar panels makes electricity production circular,
as does the production of electricity from windmills when the windmills are recycled after they wear out. Sustainability
includes circular reuse of greenhouse gas (GHG) CO2 scooped out of the air, chemically combined with water to produce
kerosine that produces CO2 when burned to power, say, an airplane. Hence the cycle is completed.
Thus, sustainability is a goal defined as follows:
Sustainability goal: the goal of sustainability is to produce goods and services using processes as close to adiabatic as pos-
sible and employing circular economy principles where diabatic processes are used. In the context of CIKR, the goal is to
improve CIKR sustainability using circular economy principles.
Societal investments in six key green technologies could yield massive and lasting benefits for the US economy:
●● Advanced nuclear power generation
●● Clean steel production
●● Direct air CO2 capture
●● Mass adoption of electric vehicles
●● Green hydrogen as a natural gas replacement and for use in fuel cells
●● Long-duration or grid-scale energy storage
Together, a future green economy can have a market value of $2 trillion a year by 2050, equal to roughly 10% of current
US gross domestic product. This is the challenge for the twenty-first century.
1.2.4 The Four Horsemen

The DHS recognizes the following threats/hazards18:
●● Climatological events (extreme temperatures, drought, wildfires)
●● Hydrological events (floods)
●● Meteorological events (tropical cyclones, severe convective storms, severe winter storms)
●● Geophysical events (earthquakes, tsunamis, volcanic eruptions)
●● Pandemics (global disease outbreaks)
●● Space eeather events (geomagnetic storms)
●● Technological and industrial accidents (structural failures, industrial fires, hazardous substance releases, chemi-
cal spills)
●● Unscheduled disruptions (aging infrastructure, equipment malfunction, large-scale power outages)
●● Criminal incidents and terrorist attacks (vandalism, theft, property damage, active shooter incidents, kinetic attacks)
●● Cyber incidents (denial-of-service attacks, malware, phishing)
●● Supply chain attacks (exploiting vulnerabilities to cause system or network failure)
●● Foreign influence operations (to spread misinformation or undermine democratic processes)
●● Untrusted investment (to potentially give foreign powers undue influence over American critical infrastructure)
This extensive list would fill a dozen books! Instead, we will examine four major groups, beginning with weather/climate
change/global Warming:
●● Weather/climate change/global warming
●● Accidents/aging/neglect
●● Terrorism/extremists
●● Cyber exploits/criminals
18 https://www.cisa.gov/sites/default/files/publications/Guide-Critical-Infrastructure-Security-Resilience-110819-508v2.pdf
16 1 The Challenge
1.3 Weather/Climate Change/Global Warming
Global warming has become a controversial topic. Often weaponized for political purposes, the argument is moot –
the Earth is getting warmer, which leads to greater risk, especially to CIKR systems. Climate change is responsible
for storms, winds, fires, and perhaps even earthquakes of greater magnitude and duration than ever before – at least
as far back as we can tell. The impact on CIKR is obvious – we experience larger events more often and with greater
consequences.
Hence, a thorough understanding of climate change is a prerequisite to understanding the threat/hazard surface. The
following is a survey of climate change and its impact on risk and resilience of infrastructures [5]. Hopefully, the skeptical
reader will find answers to the following questions:
1) How do we know the Earth is warming up?

2) Hasn’t it happened before, so why worry?
3) Is it caused by humans, if so, can we do anything about it?
4) Is global warming just a passing bump in the weather road?
Life on Earth has been threatened so many times before that reports of existential near misses have become rather rou-
tine. For example, the Carboniferous Rainforest Collapse (CRC) 305 million years ago sent Earth into a short ice age that
eliminated dense vegetation in Europe and America. CRC created vast coal seams that we now burn as power plant fuel.
Some scientists claim it was the result of very large volcanic plumes that blotted out the sun. Others say it was caused by a
swarm of asteroids attacking all at once.
An even more serious event called the Permian–Triassic Extinction (Great Dying) occurred 252 million years ago, and
nearly ended us before we had a chance to begin. The Great Dying wiped out 96% of marine animals and 70% of terres-
trial life. It took 10 million years to recover! Again, the calamity was due to an abrupt climate change – a sudden release
of methane, which is a GHG. These gases are thought to have
North pole emanated from fires and volcanoes.
More recently, scientists using archeological traces found in
Greenland rocks, soils, and trees have evidence of abrupt cooling. The
Alaska
Younger Dryas Stadial event 12,000 years ago is known as the Big
Russia Freeze because immediately after the event, Earth’s temperature
suddenly dropped. This cold spell lasted for 1300 years and
United States Europe established the Siberian land bridge that opened the door
China between Asia and North America so humans could migrate into
the Western Hemisphere.
The Big Freeze might have been caused by a shift in the jet
India
Africa stream or an extreme solar flare, but a more likely explana-
tion is that spillage from Lake Agassiz stalled the meridional
South America overturning circulation (MOC) system of ocean currents that
Australia
warms the Northern Hemisphere. MOC is also a kind of ther-
mohaline circulation system that moves water and heat from
the southern to the northern hemisphere. But MOC and
thermohaline circulation are mouthfuls, so many people call
Antarctica
the North American thermohaline circulation system the
Figure 1.2 The Atlantic conveyor is part of the global Atlantic conveyor because it works like a heat conveyor belt
circulation system of water currents called moving warm water northward and cold water southward,
Thermohaline Circulation – the movement of oceans
see Figure 1.2. The Atlantic conveyor controls the tempera-
from the Southern Hemisphere to the North. Warmer
water flows from the Indian Ocean, around South Africa, ture of the entire planet much like a thermostat controls a
up the Gulf Stream bordering Eastern United States, and room’s temperature.
to Greenland. It distributes its heat to North America Earth’s temperature has never traveled in a straight line. It
and Europe and then cools in the North Atlantic. The
seems to oscillate from one extreme to another extreme.
cooler water sinks below the surface, and returns back
to the Antarctic and Indian Ocean, where the cycle Dansgaard–Oeschger (D–O) Events are periodic warming epi-
repeats. Source: Adapted from NASA/JPL [6]. sodes lasting a few decades followed by longer cooling periods.
1.3 Weather/Climate Change/Global Warmin 17
The last one was 11,500 years ago. Greenland warmed by 4 °C within a relatively short 40 years, and then cooled down
only to warm up again.
Large sheets of ice, called glaciers, can also change the Earth’s temperature by melting and freezing. Bond Events are
warming-cooling oscillations that occur about every 1470, plus or minus 500, years. They mostly happen in the North
Atlantic. Nine cycles have been observed so far. Fred Singer and Dennis Avery report, “The Earth has been in the
Modern Warming portion of the current cycle since about 1850, following a Little Ice Age from about 1300 to 1850. It
appears likely that warming will continue for some time into the future, perhaps 200 years or more, regardless of
human activity.”19
Recorded history of global warming and cooling suggests that the current warming period is just another natural event
and there is nothing to worry about. The difference now is that warming is happening at the speed and intensity never before
experienced. There is very little time to plan and adapt. Critical infrastructure must be protected now, and there is not much
time. Climate change is different this time because it is made by humans and it is happening fast.
1.3.1 The Carrington Event

Early in the morning of 1 September 1859, amateur astronomer Richard Carrington cranked open the dome of
his private observatory to scan the bright London sky. The sunspots attracted his attention, so he aimed his nine-
teenth century telescope toward the sun and began sketching what he saw, “two patches of intensely bright and
white light” erupting from the sunspots.20 The flares vanished almost as suddenly as they appeared, but within
hours, their impact was felt across the entire globe. Later that day, telecommunications (telegraph) began to fail
around the world. Some machines showered operators with sparks and set papers on fire. Bright and colorful aurora
borealis “light shows” appeared all over the planet. Some birds and people thought it was the beginning of a new day
and set about chirping and going to work. Other animals and people thought it was the Big One and began preparing
to meet their creator.
Carrington observed the largest known solar flare – a massive solar explosion with the energy of 10 billion atomic bombs.
Traveling at the speed of light across the 93 million miles between the sun and Earth, the flare eventually reached Earth.
Its electrified gas and subatomic particles produced a geomagnetic storm – dubbed the Carrington Event. Geomagnetic
storms contain highly charged EMP (electromotive potential) particles that play havoc with electronic systems. In 1883,
this meant telegraphy. But in 2023, messing with electronics means messing with just about everything we depend on for
modern life.
Ice core samples confirm that the Carrington Event was twice as big as any other solar storm in the last 500 years. A 2008
report from the National Academy of Sciences claims it could cause “extensive social and economic disruptions” due to its
impact on power grids, satellite communications, and GPS systems [7].
Power grid engineers are concerned that a Carrington Event might melt the copper wires in power lines and scramble
circuits in control computers. The impact could be enormous because modern life depends on electrical power to run the
Internet, transportation systems, factories, offices, and food and water supply systems. For example, a geomagnetic storm
in March 1989 left six million people in Quebec, Canada, without power for nine hours.
While scientists have been measuring Earth’s evolving and complex nature for perhaps hundreds of years, the Carrington
Event marks the beginning of climatology – the study of Earth’s climate. It embraces elements from atmospheric sciences,
physical geography, oceanography, and biogeochemistry. Moreover, Carrington’s hand-drawn sketches of sunspots mark
the beginning of a new idea – that Earth is part of an ecosystem that extends beyond land, sea, and air.
Climatology is about systems and how they interact in complex ways. And as Earth’s ecosystem evolves, it changes the
very life it spawned. Humans are a product of this ecosystem. As it changes, so must we. The Carrington Event illustrates
the stochastic nature of catastrophic events – they are unpredictable, and their impact can be relatively small or
black swans.
19 The Physical Evidence of Earth’s Unstoppable 1,500-Year Climate Cycle. S. Fred Singer President, Science and Environmental Policy Project,
Adjunct Scholar National Center for Policy Analysis, and Dennis T. Avery, Senior Fellow, Hudson Institute. NCPA Policy Report No. 279
September 2005 ISBN #1-56-808-149-9.
20 http://www.thetruthdenied.com/news/2012/12/10/geomagnetic-storms-and-their-impacts-on-the-u-s-power-grid-pole-shift/.
18 1 The Challenge
1.3.2 Black Bodies

A few decades before Carrington discovered sunspots from observations made using his personal telescope, a Scottish
engineer named William Thomson was knighted for his role in laying the first transatlantic cable connecting Europe with
the new world. Sir William Thomson, Baron Kelvin of Largs, Lord Kelvin of Scotland (1824–1907) is better known for his
breakthrough paper, On an Absolute Thermometric Scale, an even greater contribution to science. Lord Kelvin calculated
the temperature of the coldest thing in the Universe, and established the yardstick used today to measure global tempera-
ture. Absolute zero is the temperature of matter when not a single molecule moves. Zero is −273 °C to you and me. It is
273 °C below the temperature of frozen ice. One-degree K is equal to 1 °C, but measurements begin at zero in the Kelvin
scale, denoted by K.
All life on Earth depends on radiant energy from the sun, as shown in Figure 1.3. That energy is quickly turned into heat
to keep the oceans circulating, the air cycling, and plants and animals growing. Accordingly, the Earth must maintain a bal-
anced energy budget – an accounting system whereby heat arriving on Earth must also leave because if any heat is trapped
here on Earth, it contributes to a gradual (or abrupt) rise in temperature. And since terrestrial life has adapted to tempera-
tures in a relatively mild range centered on 288 K, any departure from this sweet spot is considered a threat to all life. Simply
put, all living things on planet Earth depend on a fragile balance between heat coming in and heat leaving the planet.
The famous Stefan–Boltzmann Law relates heat to Kelvin temperature. It says the amount of heat radiated by a com-
pletely black ball of matter is proportional to its temperature raised to the fourth power. As a result of these pioneers work,
today we measure temperature in °C or °K. The goal is to limit the rise in temperature to 1.5 °C. This may not seem like
much, but 4.0 °C crosses a tipping point leading to disaster.
The Earth is considered as gray body instead of a perfect black body, because much of sun’s energy bounces off the atmos-
phere, clouds, land, and sea. The process of reflecting heat is called albedo, and the fraction of energy reflected by a body is
called emissivity. The average emissivity of Earth is about 39%. This means only 61% of sun’s energy reaches Earth. Even
after the Earth’s continents and seas are heated by the remaining 61%, Earth temporarily stores accumulated heat and then
radiates it back into space, according to the Stefan–Boltzmann Law.
When Earth’s energy budget is in balance, heat in equals heat out, and life goes on.
If the sun were to stop shining, Earth would eventually return to absolute zero. If the sun’s radiation increased, as it does
during solar storms, Earth’s temperature rises until another equilibrium temperature is reached and the Stefan–Boltzmann
Law kicks in and radiates heat back into space to maintain equilibrium. If the sun’s rays remain unchanged, Earth’s heat
Incoming Outgoing
solar radiation long wave
Reflected
341.3 wm2 radiation
solar radiation
101.9 wm2 239 wm2
Reflected Emitted by
Atmospheric
by clouds atmosphere window
79 wm2 199 wm2 40 wm2
Absorbed by Absorbed by
atmosphere GHG Greenhouse
78 wm2 356 wm2 gases (GHG)
Reflected Back
by surface radiation
23 wm2 333 wm2
Thermals Evapo-
Absorbed Surface
reflected transpiration radiation
by surface 17 wm2 80 wm2 Absorbed
161 wm2 396 wm2
by surface
333 wm2
Earth
net 0.9 wm2
Figure 1.3 A simple model of the Earth’s heating and cooling system is sometimes referred to as the Earth’s energy budget.
Source: Adapted from NASA/JPL [6].
1.3 Weather/Climate Change/Global Warmin 19
Temperature variation since 1880

1.6
1.4
Temperature variation, C
1.2
1.0
0.8
0.6
0.4
0.2
0.0
1860 1880 1900 1920 1940 1960 1980 2000 2020 2040
Year
Figure 1.4 Rise in SST from 1880 to 2020. Global temperature is increasing at an exponential rate.
budget remains in equilibrium between heat in and heat out. The Earth’s temperature remains steady under equilibrium
conditions.
The key to understanding global warming is in Figure 1.3, but the underlying mechanisms driving the processes in
Figure 1.3 are not well understood. This is why climatology is still a young science. A number of climatology models have
been developed and back-tested to validate them against historical data. Admittedly, the evidence is more empirical than
theoretical, so a certain amount of skepticism is warranted. But it is a start.
The first question most people ask is, “How do we know the Earth is warming up?” That is, how do we know there is an
imbalance in Earth’s energy budget? To answer this question, we can study temperature anomalies recorded over the past
100 years or more. Anomalies are departures from recent historical measurements of temperatures taken throughout the
year and across the globe. Then we can compare recent measurements against previous years’ measurements to determine
the size of anomalies and determine any trends.
Figure 1.4 plots Sea Surface Temperature (SST) anomalies obtained from the dataset maintained by the UK Met Office
Hadley Center. It is one of the most trusted and respected science centers in climatology. SST readings are collected from
nearly 2600 latitude and longitude squares beginning at the International Dateline and the North Pole and moving eastward.
Obviously, these measurements exclude land temperatures. Also, they are anomalies, not absolute values. Therefore, an
anomaly of 0.5° means the temperature at that square is one-half of a degree above an historical baseline value. Typically,
the baseline is an average calculated in 1960, 1980, or perhaps 1880 (pre-industrialization). Figure 1.4 shows measurements
made relative to 1980.
Is warming caused by an increase in the world’s population? Is it caused by the GDP or public debt? All of these are
increasing, and all correlate with SST! Correlation is not the same as causation, but if we are looking for a perfect fit, the
concentration of GHG in the atmosphere has the strongest correlation and a scientific basis for increasing SST. Using
Occam’s razor, increasing concentrations of GHGs are the best explanation for global warming. It is based on science,
not politics.
Table 1.2 lists the top sources of CO2 emissions in 2019. Note that two- Table 1.2 Contribution to global warming in
thirds of the problem is concentrated on two sectors – transportation and terms of CO2 emissions (2019).
electric power generations. Both are due to burning fossil fuels. This is where
we need to focus attention. This is where transformation will happen. Economic sector %CO2
Transportation 34.6
1.3.3 The Lightening Rod
Electric power 30.7
James Edward Hansen has been called a hero for advocating anthropogenic Industrial 15.6
(human-caused) global warming and also criticized for overestimating its Residential 6.7
dangers. He is perhaps the staunchest spokesperson for global warming,
Commercial 4.8
having received numerous awards for his 40 years of climatology research
Other 7.6
and “courageous and steadfast advocacy in support of scientists’ responsi-
bilities to communicate their scientific opinions and findings openly and Source: Adapted from [8].
20 1 The Challenge
CO2 strongly correlated with temperature rise

450
425
400
CO2 concentration, ppm
375
350
325
300
275
250
225
200
–0.4 –0.2 0 0.2 0.4 0.6 0.8 1 1.2
Temperature, C
Figure 1.5 CO2 is the most consequential GHG since 1960. SST is strongly correlated with CO2 concentrations and suggests
continued increases unless CO2 emissions are reduced. Source: Adapted from [9].
honestly on matters of public importance.”21 In 2011, Hansen was arrested while protesting in front of the White House.
He has become a lightning rod in the debate over whether climate change is caused by industrialization or is simply
another Bond Event. If we believe Figure 1.5, CO2 emissions are driving global warming just as they did on Venus.
Hansen began his journey to celebrity as a 1960s and 1970s student of the Venusian climate. Venus’ climate may have
been similar to Earth’s several million years ago. But a runaway greenhouse effect evaporated its water and turned the sec-
ond planet into an uninhabitable hothouse. Hansen worries that Earth’s fate may be the same [10].
Furthermore, he believes that the future of Earth’s climate is in humanity’s hands. We can ruin the planet or save it, depend-
ing on our policy choices. We can prevent another runaway greenhouse disaster by shutting down coal-burning power plants,
adopting energy efficiency policies, switching to renewable energy, converting our old dumb power grid to a smart grid, and
producing electricity using fourth-generation nuclear reactors that burn nuclear waste rather than p
roducing it [11].
The bottom line is that we must turn to circular economy renewables to generate electricity and power everything with
electric motors instead of burning fossil fuels. And we have less than a decade to transition.
1.4 Consequences
Regardless of whether Hansen’s warnings come true or not, a prudent race of earthlings would be wise to prepare for the
worst. Otherwise, the Big One may be a black swan we cannot recover from. What if nothing is done to repeal projected
rises in temperatures around the globe? The Intergovernmental Panel on Climate Change (IPCC) report warns of disas-
trous consequences:
●● Warming lakes will reduce water quality.
●● Heat mortality will increase.
●● Diseases will spread more widely.
●● Droughts will induce water shortages.
●● Crop failures will lead to starvation.
●● Warming oceans will kill species and reduce food supplies. Rising sea levels will cause flooding.
●● Higher coastal waves will cause tsunami damage.
●● Intensified storms (superstorms) cause widespread damage.
It may be worse. The IPCC largely assumes linearity and ignores possible tipping points or black swans like a series of
Krakatau-sized volcanoes, unexpected rises in aerosols, etc. Finally, nobody knows the effect of “deep-ocean mixing,”
whereby deeper layers of the ocean absorb heat and CO2 to balance Earth’s energy budget. What if absorption of heat into
the ocean is delayed by 60 years?
21 http://en.wikipedia.org/wiki/James_Hansen.
1.4 Consequence 21
We must hope for the best but be prepared for the worst. CIKR will be the first line of defense against crippling effects on
civilization.
1.4.1 Accidents/Aging/Neglect
One of the greatest American tragedies of infrastructure failure due to neglect and aging is the Flint Michigan drinking
water debacle. Flint is the birthplace of General Motors (GM) and had a population of 200,000 at one time. Then the
city’s economy failed, along with GM’s decline due to foreign imports. But in the 1980s, the population declined to
100,000 citizens of which 45% were living below the poverty line. In 2011 the city failed, financially, and the state of
Michigan took control.
In classic normal accident style (normal accidents will be studied in the next chapter), the state-appointed emergency
manager ended the city’s practice of piping treated water from Detroit in favor of a cheaper alternative of pumping water
from the Flint River. Unfortunately, the Flint River served as a dumping ground for pollutants from adjacent industries and
wastewater from the city.
For more than a century, the Flint River, which flows through the heart of town, has served as an unofficial waste
disposal site for treated and untreated refuse from the many local industries that have sprouted along its shores,
from carriage and car factories to meatpacking plants and lumber and paper mills. The waterway has also received
raw sewage from the city’s waste treatment plant, agricultural and urban runoff, and toxics from leaching landfills.
Not surprisingly, the Flint River is rumored to have caught fire – twice.22
It did not take long before the residents started complaining about the foul water in their water faucets. Things got worse
when the city increased chlorine levels to treat the contaminated water. But this compounded the problem by making peo-
ple sick from elevated levels of cancer-causing chemicals that are a byproduct of chlorination of water.
In early 2016, a coalition of citizens and groups – including Flint resident Melissa Mays, the local group Concerned
Pastors for Social Action, NRDC, and the ACLU of Michigan – sued the city and state officials in order to secure safe
drinking water for Flint residents. Among the demands of the suit: the proper testing and treatment of water for lead
and the replacement of all the city’s lead pipes. In March 2016, the coalition took additional action to address an
urgent need, filing a motion to ensure that all residents – including children, the elderly, and others unable to reach
the city’s free water distribution centers – would have access to safe drinking water through a bottled water delivery
service or a robust filter installation and maintenance program.
Those efforts paid off. In November 2016, a federal judge sided with Flint residents and ordered the implemen-
tation of door-to-door delivery of bottled water to every home without a properly installed and maintained fau-
cet filter. A more momentous win came the following March with a major settlement requiring the city to
replace the city’s thousands of lead pipes with funding from the state, and guaranteeing further funding for
comprehensive tap water testing, a faucet filter installation and education program, free bottled water through
the following summer, and continued health programs to help residents deal with the residual effects of Flint’s
tainted water.23
This terrible incident in Flint illustrates how critical and fragile an infrastructure like water and water treatment is to
daily life. Even simple things such as drinking water may be subject to collapse due to neglect, accident, or aging.
1.4.2 The Report Card

The American Society of Civil Engineers (ASCE) Report Card for America’s Infrastructure gave infrastructure a C-grade in
2021, up from a D in 2020, see Table 1.3. When climate change is considered, the grade drops to an F. “We decided that, if
we add climate change to those grades, everything would be an F.”24
22 https://www.nrdc.org/stories/flint-water-crisis-everything-you-need-know#sec-summary.
23 https://www.nrdc.org/stories/flint-water-crisis-everything-you-need-know#sec-summary.
24 https://www.enr.com/articles/52849-asce-guide-examines-climate-change-threats-to-infrastructure-how-to-prioritize-projects.
22 1 The Challenge
Table 1.3 ASCE report card for 2021. Overall grade

of C− but trending up.
Infrastructure Grade
Aviation D+
Bridges C
Dams D
Drinking water C−
Hazardous waste D+
Inland waterways D+
Levees D
Ports B−
Public parks D+
Rail B
Roads D
Schools D+
Solid waste C+
Stormwater D
Transit D−
Wastewater D+
Source: Adapted from [12].
Of course, physical infrastructure is built by civil engineers, architects, and construction crews, so they are in a good
place to evaluate physical infrastructure. In 2022, the ASCE estimated the cost to upgrade US physical infrastructure sys-
tems at $2.6 trillion over 10 years. How will the money be spent? Priorities are difficult to be set when CIKR is interdependent –
a failure in one often cascades to another. The domino effect of one sector such as the power grid spreading a fault to
another sector such as communications and transportation (stop lights) complicates setting of priorities. Interdependencies
introduce complexity and complex systems behave in unexpected and nonlinear ways.
1.4.2.1 The Domino Effect

Interdependent complex systems that domino require special considerations. Cascading is the term used to describe the
spread of a fault in one place causing faults in other places. For example, the state of Texas experienced a black swan power
grid failure in 2021 due to an unusually cold winter storm. The Electric Reliability Council of Texas (ERCOT) relies on
natural gas production to generate electricity, and natural gas production relies on electricity to produce natural gas. Any
fault in the loop breaks the entire system. At one point during the 2021 storm, more than half of the state’s natural gas sup-
ply shut down because of power outages, frozen equipment, and weather conditions.
Cascading is more common than one might think because CIKR sectors are interconnected in most modern societies.
The potential for cascading is exacerbated by optimization and cost-cutting to increase profits and efficiency. The Internet
is a classic example. Initially designed to be highly redundant and resilient, the number of servers and routes have consist-
ently centralized for economic reasons. Today’s Internet is vulnerable to cascade failures due to reduced servers and
links [13].
1.4.3 Terrorism/Extremists
Mohamed Mohamed el-Amir Awad al-Sayed Atta was born in Egypt on 1 September 1968. His strict father demanded his
children be educated, so Atta attended Cairo University to study architecture. In 1992 Atta entered the Carl Duisberg
Gesellschaft international student exchange program and moved to Germany where he lived in a house provided by a
Hamburg couple while attending the Technical University of Hamburg-Harburg, majoring in urban planning. Upon gradu-
ating, he worked for Carl Duisberg as a tutor and seminar participant throughout Germany circa 1995–1997 [14].
1.4 Consequence 23
Atta became more religious and more critical of the Gulf War and US policy in the Middle East while studying and
working in Germany. According to the 9/11 Commission Report, Atta expressed anti-Semitic and anti-American sentiment
and condemned the “global Jewish movement centered in New York City” that supposedly controlled the financial world
and the media. Atta considered New York City the heart of America. If you want to kill America, strike its heart.
Mohammed Haydar Zammar claims he recruited Atta into al-Qaeda. According to the FBI, Atta established the Hamburg
cell of the al-Qaeda terrorist network when he moved into an apartment with alleged terrorists Said Bahaji and Ramzi
Binalshibh in November 1998. Many other al-Qaeda members lived in the same apartment building, including Marwan
al-Shehhi, Zakariya Essabar, Waleed al-Shehri, and others. Twenty-nine men claimed the apartment as home while Atta’s
name was on the lease, including the 9/11 mastermind Khalid Sheikh Mohammed who repeatedly visited the apartment.
In late 1999 through early 2000, Atta, al-Shehhi, Jarrah, Bahaji, and Binalshibh studied terrorist tactics with Osama bin
Laden at Tarnak Farms, near Kandahar, Afghanistan. The CIA observed Atta buying large quantities of chemicals after
returning to Germany in 2000. During this time Atta contacted 31 flight schools in the United States regarding flight train-
ing. Then he traveled to Prague, stayed overnight, and departed for the United States via Newark, New Jersey. The CIA
stopped watching Atta after he entered the United States on 3 June 2000. After all, the CIA does not spy inside of the United
States! The CIA’s job was done.
Atta and other hijackers in the United States began flight school training in July 2000. He and Marwan al-Shehhi enrolled
at Huffman Aviation in Venice, Florida, where both men earned their instrument certificates from the FAA in November.
They continued flight training by watching flight deck videos purchased from Sporty’s Pilot Shop in Batavia, Ohio. They
even practiced flying commercial jets using the Boeing 727 simulator at the Opa-locka Airport near Miami. Atta and
Marwan were awarded pilot’s licenses on 21 December 2000.
Throughout the summer of 2001, Atta visited Boston, San Francisco, Las Vegas, Spain, and Switzerland, apparently meet-
ing fellow terrorists to plan the 9/11 attacks. In July he met with Binalshibh in Spain, and according to U.S. officials and the
Spanish police, Atta drove halfway across Spain to meet with hijackers Wail and Waleed al-Shehri, and Binalshibh. Pere
Gomez, manager of Hotel Monica in Spain, said the receptionist on duty refused to rent them a room because she did not
like the look of Binalshibh. They later returned and stayed the night. The growing network of hijackers reportedly met
al-Qaeda’s Spanish point man Imad Yarkas during this trip and coordinated the details of the 9/11 attacks. They ruled out
an attack on a nuclear plant and instead decided to hit the World Trade Center.
The day before 11 September 2001, Atta collected al-Omari from the Milner Hotel in Boston and drove to a Comfort Inn
in Portland, Maine, where they spent the night in room 232 only to return back to Boston the following morning. Authorities
speculate that this maneuver was designed to avoid strict security checks at Logan Airport in Boston. At 6:45 a.m. on
11 September, Marwan al-Shehhi called Atta to confirm that the attacks were ready to begin.
The plane departed Boston with 81 passengers at 7:59 a.m. At 8:24 a.m. air traffic controllers heard a voice believed to be Atta’s
saying, “We have some planes. Just stay quiet and you will be OK. We are returning to the airport. Nobody move, everything will
be OK. If you try to make any moves, you’ll endanger yourself and the airplane. Just stay quiet…”. Atta is believed to have been
the pilot of the plane when it crashed into the north tower of the World Trade Center 23 minutes later at 8:46:40 a.m.
Everyone on the planet remembers 9/11, when a group of terrorists attacked the United States using commercial airliners
as weapons. Whenever terrorism is discussed, most people think of the 9/11 terrorists. But terrorism is a narrowly defined
act committed by non-state actors:
Terrorism: The threatened or actual use of illegal force and violence by a non-state actor to attain a political, eco-
nomic, religious, or social goal through fear, coercion, or intimidation.
Data collected since 1970 suggests that most terrorist attacks are for political purposes and not to damage critical infra-
structure. With the exception of cybercrime, acts of terror are narrowly focused and declining. Summarizing25:
●● The highest proportion of unsuccessful attacks since 1970 occurred in 2011 – four out of nine recorded attacks were
unsuccessful.
●● From 2001 to 2011 California (40) and New York (19) experienced the most total terrorist attacks against the US homeland.
●● The three cities in the United States that experienced the most attacks from 2001 to 2011 were New York City (12),
Washington, DC (9), and Los Angeles (8).
25 https://www.theguardian.com/news/datablog/2013/apr/17/four-decades-us-terror-attacks-listed-since-1970#data.
24 1 The Challenge
●● The most common weapons used in terrorist attacks in the United States from 2001 to 2011 were bombs (53% of all
weapons used) and explosives (20% of all weapons used).
●● For the period from 2001 to 2011, biological weapons were tied with firearms as the third most common weapon used in
terrorist attacks (both represented 8% of all weapons used). This is due to the anthrax attacks in October 2001.
●● From 2001 to 2011, the most common targets of terrorists in the United States were businesses (62 attacks), private
citizens and property (59 attacks), and government (43 attacks).
●● The three terrorist organizations with the largest number of attacks on the United States from 2001 to 2011 were the
Earth Liberation Front (50), the Animal Liberation Front (34), and al-Qaeda (4).
Physical attacks with costly consequences aimed at infrastructure are rare [15]. The number of attacks since 1970 has
s teadily declined as well as the number of human casualties. Eighty-nine percent of all deaths due to terrorist attacks in the
United States during this time period were caused by the 1995 bombing of the Alfred P. Murrah Federal Building in
Oklahoma City (5%) and the 11 September 2001 attacks (84%). More than 90% of all attacks that targeted critical infrastruc-
ture were nonlethal, compared to just over 80% of attacks that did not target critical infrastructure. In contrast, 15% of
attacks that did not target critical infrastructure resulted in a single death compared to 5% of attacks that did target critical
infrastructure.
Statistically, physical attacks on CIKR obey what is called a long-tailed distribution, see Figure 1.6. By long-tailed, we
mean that the distribution rapidly declines as the number of deaths or targets increases. The distribution is skewed to the
left with highly likely events of low consequence and rare events of high consequence.
Number USA attacks on CIKR (1970–2015)

2000 1854
1500
Number
1000
500
90 31 4 4 4
0
0 1 3 8 100 200
Deaths
Number USA attacks on CIKR (1970–2015)

500
454 433
450
400
350
300 281
Number
250 222
190
200
157
150 109
89
100
54 24 18
50
8 6 5 4 1
0
al
th
es
gy
re
al
ns
ls
s
en
ce
em
em
og
am
as
in
ia
ci
ic
al
tu
ic
er
tio
ur
m
er
er
vi
he
lb
ol
ul
rv
st
st
D
En
ca
n
ct
er
he
m
hn
at
ic
se
ria
sy
sy
er
ic
a
ls
i
om
,m
un
C
c
ag
uf
ov
bl
st
te
ia
e
an
nc
pu
tio
m
du
C
rs
G
at
c
n
om
an
to
ge
an
m
ta
in
ew
io
d
ac
or
an
at
n
er
al
e
C
od
t
Fi
as
s
sp
rm
re
ic
Em
en
lth
Fo
rit
,w
an
fo
ar
ea
ef
In
le
Tr
er
D
H
uc
at
N
W
Figure 1.6 CIKR attack statistics are long-tailed – most attacks result in one death, most targets are in the commercial and
government sectors, and most are bombings.
1.4 Consequence 25
By far the preferred weapon used in an attack is a bomb. Neither the attacks nor the weapons used are random. Therefore,
aggregation of results in terms of average value is meaningless. Instead, one has to study the distributions as illustrated.
1.4.4 Cyber Exploits/Criminals

Like a thief in the night, Code Red entered through an open door – port 80 – the same door used by browsers to access web
pages from anywhere in the world. But it wasn not looking for personal information – at least not yet. Named Code Red by
eEye Digital Security employees Marc Maiffret and Ryan Permeh, who were drinking Code Red Mountain Dew when they
first detected it, the software worm sent copies of itself to thousands of randomly generated Internet addresses as it blazed a
trail through the Internet. It jumped from computer to computer using the oldest cyber trick in the book – the buffer overflow
exploit. Posing as data, buffer overflow allows malicious code into your computer so a hacker can take control. In this case, the
impostor “data” would initiate a distributed denial-of-service attack (DDOS) on the White House of the United States.
Silently and secretly, Code Red spread to other computers for 20 days, lying dormant inside of Microsoft’s Internet
Information Server until a certain time and date, when all copies simultaneously attacked www.whitehouse.gov. The force
of this malicious program was multiplied by infecting not just one, but nearly 400,000 unsuspecting “zombie” computers
before lashing out. Like a torrent of water released by a collapsing dam, millions of messages rushed toward the servers
located in Washington DC. Only this torrent wasn’t water. It was pure software – ones and zeros – that leapt from machine
to machine much like the spread of a modern Black Plague. Code Red flooded the www.whitehouse.gov servers with a tor-
rent of meaningless data.
Code Red recruited thousands of innocent and unsuspecting computers along its swath. The unsuspecting
participants – called zombies – became unwilling co-conspirators in a crime of national scope. Zombie computers form
a kind of network – a botnet – for the purpose of massively attacking a single target. Botnet zombies derive their power
from numbers: at a prespecified date and time, the entire botnet of zombies floods the victim’s computer with half-
completed requests for attention. But once they get the victim’s attention, they ignore it!
1.4.4.1 Black Hats

Black Hats are malicious hackers – people who break into networks for the purpose of doing harm. They use a variety of
tools and techniques to perpetrate cyberattacks known as exploits. Script Kiddies are amateurs, but Black Hats are serious
criminals. They are also very clever and often border on genius. Perhaps this is one reason they are drawn to cybercrime – to
commit a serious cybercrime you have to be seriously clever. In some cases, Black Hats establish their reputation through
crime but earn their fortunes through honest security work at reputable Internet companies. When this happens, Black
Hats become White Hats.
DDOS attacks like Code Red are the oldest of all known cyber exploits. Robert Tappan Morris first demonstrated the
basic technique, while a student at Cornell University in 1988. At the time, his father, Robert Morris was a NSA scientist
working on cybersecurity! The Morris Worm was the first computer worm set free in the wild, as hackers say, and the first
to get out of control. Morris claims he was trying to see how large the Internet was by tracking where his worm went.
Unfortunately, the Morris Worm rendered more than 6000 machines unusable.
Pioneer Morris invented the first worm – a malicious program that travels on its own. Viruses have been around longer,
but they require human intervention because viruses travel with humans. For example, a virus might jump from one com-
puter to another via a shared disk drive or other storage device that is moved from one computer to another by a user.
A worm, on the other hand, spreads clandestinely through the Internet, via email attachments, web pages, etc.
Morris was also the first person prosecuted under the 1986 Computer Fraud and Abuse Act. He was convicted and sentenced
to three years’ probation, required to perform 400 hours of community service, and fined $10,000. But his story did not end
there. Like many hackers, Morris went on to become one of the foremost computer network researchers in the country.
He cofounded and sold a company named Viaweb to Yahoo for $48 million in 1995. Yahoo renamed it Yahoo Store. Later
he earned a Harvard PhD in 1999. Today he is a tenured professor of Computer Science at the MIT Computer Science and
Artificial Intelligence Laboratory researching network architectures.26 His friend and co-entrepreneur partner Paul
Graham says, “Robert is never wrong.”27
26 www.itsecurity.com.
27 http://en.wikipedia.org/wiki/Robert_Tappan_Morris.
26 1 The Challenge
1.4.4.2 Cybercrime Pays

Morris avoided serving time, but 16-year-old Jonathan James achieved a small amount of fame as the first juvenile to serve
prison time for hacking. He targeted high-profile organizations like NASA and the Department of Defense. According to
the Department of Justice, James cracked into NASA computer systems and downloaded the International Space Station’s
control software worth $1.7 million. NASA was forced to shut down its computer systems at a cost of $41,000. When
caught, James claimed the exploit helped him study C programming and observed that the NASA code was “crappy” and
hardly worth $1.7 million. He was banned from recreational computer use and eventually served six months in prison for
violation of parole. James’ ambition after getting out of jail was to start a computer security company and get rich the old-
fashioned way – by earning it.
Adrian Lamo – the homeless hacker – cracked computer systems at The New York Times, Yahoo, Bank of America,
Citigroup, and Microsoft. Lamo, a Colombian-American who lived in Wichita, Kansas, was once nicknamed the “homeless
hacker” because he would drift across the United States on Greyhound buses, finding shelter with friends or in vacant
buildings. Lamo would find flaws in his victim’s information technology security, exploit them, and then tell the companies
about their vulnerabilities. For example, he broke into the New York Times internal network to look at personal informa-
tion such as social security numbers. He may have pioneered another racket: a decade later, cyber extortion is big business.
Modern Black Hats extort World Wide Web companies by promising to not attack their sites in exchange for money.
He is perhaps best known for high-profile hacks of companies like Microsoft, and later for turning in Chelsea Manning after
receiving leaked classified documents from her. Manning gave Lamo classified video allegedly showing a 2009 air strike in
Afghanistan that killed nearly 200 civilians.
Lamo was eventually caught and ordered to pay approximately $65,000 in restitution and sentenced to six months of
home confinement plus two years of probation. After his probation expired on 16 January 2007, Lamo began working as
an award-winning journalist and public speaker. He was working for a threat analysis company in Sacramento, California
in 2009, according to his online bio. He died in 2010 at the age of 37.
Perhaps the best-known Black Hat is Kevin Mitnick – the self-proclaimed “hacker poster boy.” The Department of Justice
described him as “the most wanted computer criminal in United States history.” Mitnick may have benefitted from overly
exuberant publicity from two movies: Freedom Downtime and Takedown. Like traditional wiseguy gangsters, Mitnick began
his career as a small-time thief, hacking the Los Angeles bus-ticketing system for free rides. Then he dabbled in phone
phreaking – manipulating the telephone system to make free long-distance calls. His online bio says, “[My] hobby as an
adolescent consisted of studying methods, tactics, and strategies used to circumvent computer security.”28
Mitnick was eventually caught and convicted of breaking into the Digital Equipment Corporation’s computer network and
stealing software. He served five years – about eight months of it in solitary confinement. He became a computer security
consultant, author, and speaker, appearing on 60 minutes, The Learning Channel, Court TV, Good Morning America, CNN,
and National Public Radio. He is the author of two books: The Art of Deception (2002) and The Art of Intrusion (2005).
Dark Dante, who is Kevin Poulsen in real life, worked for SRI International by day and hacked by night. His most famous
hack won him a brand-new Porsche. Each week the Los Angeles radio station KIIS-FM ran a “Win a Porsche by Friday”
contest. The station awarded a $50,000 Porsche 944 to the 102nd caller following a preannounced sequence of songs. When
the song sequence triggered the calling frenzy, Poulsen took over the station’s phone system, blocked out all other callers,
made call number 102, and drove away with the prize!
Poulson worked as a White Hat for the government but was drawn to the dark side as his skill and fame spread. In
another telephone exploit Dark Dante crashed the phone lines of the TV show Unsolved Mysteries after his photo appeared
on the show. More seriously, he hacked into the FBI database containing wiretap information – perhaps to punish the
FBI. Law enforcement dubbed him “the Hannibal Lecter of computer crime.”29 When captured, authorities found so many
hacking devices they said Poulsen put James Bond to shame. After a 17-month pursuit, Poulsen was captured in a super-
market and served 51 months in jail and was ordered to pay $56,000 in restitution.
Like so many other Black Hats, Poulsen got off easy, leveraged his expertise to get a lucrative job after serving time, and
achieved more celebrity than notoriety.30 Poulsen became a senior editor for Wired News, specializing in cybercrimes and
the people who do them. His most prominent article exposed 744 sex offenders for exploiting MySpace profiles. It seems
that our society rewards genius even when it leads to a life of crime. Who says crime does not pay?
28 http://mitnicksecurity.com/media/Kevin_Mitnick_Bio_BW.pdf.
29 http://library.thinkquest.org/04oct/00460/poulsen.html.
30 https://www.wonderslist.com/top-10-black-hat-hackers.
1.4 Consequence 27
1.4.5 The Soft War

Cyber exploits are not all done by freelance Black and White Hats. Governments are getting into the business from the
offensive side. In May 2007, US President Bush authorized the NSA to launch cyberattacks on the cellular phones and
computers operated by insurgents in Iraq to coordinate roadside bombings. The insurgents were recording the strikes and
then posting the videos on the Internet to recruit followers.31 More interesting, however, was the way the American forces
used cyber exploits to deceive the insurgents. By hacking into their network and sending messages to the unwitting insur-
gents, the Americans led the insurgents into a trap set by waiting U.S. soldiers. Cyber exploits in the virtual world can have
serious consequences in the real world.
These military hacks were partly responsible for the success of the 2007 surge in Iraq. They allowed military planners to
pinpoint and kill the most influential leaders with minimal collateral damage. But using this technology on the battlefield
is more significant than Black Hat hacking because it introduces a new weapon into modern warfare. In fact, the war in
Iraq was as much about psyops and cyber countermeasures as it was about bombs and IEDs.
The commander of coalition forces in Iraq – General Petraeus – believes in cyberwarfare. Testifying before Congress in
September 2007, the General said, “This war is not only being fought on the ground in Iraq but also in cyberspace.” The
Defense Department’s Cyber Command’s job is to defend military computer networks as well as go on offense and attack
the enemy’s network infrastructure. But the United States is not the only country to go on the cyber offensive. In addition
to traditional hot wars, nations are now ramping up to fight soft wars.
In August 2008, a dispute between the Russian Federation and neighbor Georgia over a region called South Ossetia
located on the border between Georgia and Russia initiated a vigorous and effective cyber exploit designed to augment
physical conflict between Russian and Georgian military forces. The strife began when Georgian forces launched a surprise
attack against South Ossetia separatist forces on 7 August. On 8 August, Russia responded by sending troops into Georgian
territory, which Georgian authorities viewed as Russian aggression against Georgia.
Cyberattacks were launched against a large number of Georgian government websites prior to the physical attacks. The
exploits primarily defaced public websites and denied service to a number of other sites. Attacks lasted from two to six
hours, and damages were relatively low. In some cases, websites were disabled for days following the disruptive attacks.
At first, it appeared that Russian forces were behind the cyberattacks. Later, it was discovered that the attacks were car-
ried out by Black Hats – perhaps located in Russia, but not necessarily supported by the Russian military. Research suggests
that the Russian government also did nothing to stop the attacks coming from Russia. It is impossible to trace the DDOS
attacks to their origin because the botnet used zombies. Apparently, the aim of the attackers was to block governmental
operations and discredit the Georgian government. Georgia’s government was unable to get its point of view out to the rest
of the world.
Strategies like President Bush’s authorization of information warfare against Iraqi insurgents can also backfire and get
out of control much as Morris’s Worm did. For example, military planners rejected a proposed cyberattack on Iraq’s bank-
ing system because those networks were connected to banks in France. An attack of global proportions might take down
the entire banking system! A global cyber contagion may be easier to start than to stop.
These examples illustrate how assaults on the information infrastructure of companies and countries are tools for both
good and evil. Criminals use exploits for fame, financial gain, or mischief. Countries use exploits for political and psycho-
logical offenses. Some experts claim that terrorist groups such as al-Qaeda purposely do not try to destroy the Internet
because they benefit from it too!
In any case, offensive and defensive exploits are not unlike hurricanes. They are virtual storms blowing through cyber-
space. While Internet storms may be caused by humans instead of Mother Nature, they also take on characteristics of
natural catastrophes. They are unpredictable, extreme, and rare.
1.4.6 Cyberattacks and CIKR

Cyberattacks are asymmetric – they are inexpensive to build and buy but capable of causing great financial harm. It only
takes knowledge of the Internet and coding skills to build a malicious worm, virus, or botnet. Moreover, off-the-shelf
malicious code is available for purchase over the web! Anyone can buy one and unleash an exploit on the global Internet.
The number of exploits, and cost of recovery, is growing exponentially, see Figure 1.7.
31 http://www.itsecurity.com.
28 1 The Challenge
Growth of cyberattacks on infrastructure

5,000
4,500
4,000
IC3 number (000), forecast
3,500
3,000
2,500
2,000
1,500
1,000
500
0
2016 2017 2018 2019 2020 2021 2022 2023 2024 2025 2026 2027 2028 2029 2030
Year
Figure 1.7 Cyberattacks are on the rise, and the forecast is not getting better. Globally, exploits cost trillions of dollars per year.
The most famous exploit against infrastructure so far is Stuxnet – the worm that took down Iran’s nuclear processing
centrifuges in 2009.32 The Stuxnet worm spread via USB drives that had to be inserted into a control system computer in
order to spread.
Stuxnet is a computer worm, reportedly developed and launched by the United States and Israel, that specifically
targets programmable logic controllers (PLCs) that control the automation of electromechanical processes, such
as those used for centrifuges. It is considered to be the first cyber weapon used in the world due to its ability to
cause physical destruction and the first known malware designed to infect industrial control systems (ICS).
Stuxnet is typically introduced to a network via an infected USB drive and contains three modules: a worm that
executes the main payload, an LNK file that automatically executes the propagated worm copies, and a rootkit
that hides all malicious files and processes to evade detection. The worm propagates across the network searching
for Siemens Step 7 software on computers controlling PLCs. Once the targeted machine is found, the malware
injects the rootkit onto the PLC and Step 7 software, modifies the code, and sends commands to the PLC while
displaying normal operation system information to the end user. Stuxnet was used specifically to target centri-
fuges at Iran’s uranium enrichment facility outside Natanz, Iran. It manipulated valves on the centrifuges,
increasing and decreasing their speed, putting additional pressure on them, and ultimately damaging the
machines until they no longer functioned.
Stuxnet found the controlling software for the centrifuges, seized control, and manipulated the speed of the centri-
fuges. The malware forced the centrifuges to spin very fast for 15 minutes and then return them to normal speed. Within
five months of the attack, the excessive speed changes caused the machines to break, resulting in the loss of about
1,000 centrifuges.
Unfortunately, Stuxnet was unintentionally unleashed in the wild, reportedly, when one of the engineers at an
infected facility connected his work laptop to his home network. It infected many more machines than originally
intended.
While typical attacks on infrastructure do not result in deaths, the cost of recovery may be large due mainly to labor. The
exception, of course, is ransomware, in which the threat actors encrypt files and then blackmail system owners and
operators to pay a ransom to unlock their encrypted files. More on this in subsequent chapters.
32 https://www.cyber.nj.gov/threat-center/threat-profiles/ics-malware-variants/stuxnet.
Reference 29
1.5 Discussion
The following are offered as thought-provoking questions to stimulate discussion.

A. The DHS has an evolving strategy that changes relatively quickly as compared to other government agencies such as
the National Science Foundation, Department of Defense, and Department of Agriculture. Explain why this is the case
and evaluate both pro and con arguments for a shifting strategy.
B. An enduring theme of critical infrastructure protection in the United States has centered on strong leadership from the
federal government but with engagement at the state, local, and tribal levels. Alternatives to this vertical integration of
governmental control have not emerged beyond early discussions of the National Guard as protector. Is vertical integra-
tion the best approach? What are alternatives and why might they provide better security?
C. Immediately following the 9/11 attacks the mantra of homeland security was to protect, defer, respond, and recover.
This mantra has disappeared from the discussion over the years leaving most of the emphasis on recovery. Argue either
in favor or opposition to this narrowing down of focus. Why is not protection a bigger piece of the strategy?
D. Qualitative analysis methods are by far more prevalent in critical infrastructure analysis than quantitative methods.
The reason is obvious – quantitative analysis is difficult. Argue either in favor of quantitative methods or qualitative
methods pointing out pros and cons of each.
E. The DHS employed 225,000 people in 2019 and consumed nearly $50 billion. Is it worth it? What are the alternatives?
F. The characterization of threat as the four horsemen may be too simplistic. What is the advantage – and disadvantage –
of focusing on these versus the full list provided by DHS?
G. Is the heavy focus on sustainability and resilience in the face of extreme weather and climate change justified? Is the
emphasis on cybersecurity also emphasized? What happened to the concern for terrorists and terrorist attacks?
H. Is the extreme rise in gun violence in America a concern for sustainability and resilience of CIKR? Are the two related?
References
1 Marsh, R.T. (1997). Critical foundations: protecting America’s infrastructures. The Report of the President’s Commission on
Critical Infrastructure Protection, October 1997.
2 Department of Homeland Security (2003). The National Strategy for the protection of critical infrastructures and key assets,
February. www.dhs.gov.
3 The Whitehouse (2003). Homeland security presidential directive/Hspd-7. 17 December 2003.
4 Vugrin, E.D., Warren, D.E., Ehlen, M.A. and Camphouse, R.C. A framework for assessing the resilience of infrastructure
and economic systems. Sandia National Labs. http://www.sandia.gov/CasosEngineering/resilience_assess_framework.html.
5 Lewis, T.G. (2014). Book of Extremes. Springer. pp. 183.
6 Trenberth, K.E., Fasullo, J.T., and Kiehl, J. (2009). Earth’s global energy budget. Bulletin of the American Meteorological
Society 90 (3): 311–324.
7 National Research Council (2008). Severe Space Weather Events: Understanding Societal and Economic Impacts: A Workshop
Report. Washington, DC: The National Academies Press. http://www.nap.edu/catalog.php?record_id=12507.
8 U.S. EPA (2021). Inventory of U.S. greenhouse gas emissions and sinks: 1990–2019. https://www.epa.gov/sites/default/
files/2021-04/documents/us-ghg-inventory-2021-main-text.pdf.
9 Earthobservatory. Global warming. https://earthobservatory.nasa.gov/features/GlobalWarming.
10 Hansen, J., Sato, M., Kharecha, P., and Von Schuckmann, K. (2011). Earth’s energy imbalance and implications. Atmospheric
Chemistry and Physics 11 (24): 13421–13449.
11 Hansen, J., Sato, M. and Ruedy, R. (2012). Perception of climate change. Proceedings of the National Academy of Sciences
109(14726–14727): E2415–E2423. doi:https://doi.org/10.1073/pnas.1205276109.
12 ASCE (2021). Infrastructure policy & planning: ASCE’s 2021 report card marks the nation’s infrastructure progress.
https://www.asce.org/publications-and-news/civil-engineering-source/civil-engineering-magazine/issues/magazine-
issue/article/2021/03/asce-2021-report-card-marks-the-nations-infrastructure-progress.
13 Lewis, T.G. (2015). Why physical cyber security is broken. Ubiquity, 24 August 2015.
14 Lewis, T.G. (2011). Bak’s Sand Pile, 382. Agility Press.
15 Miller, E. (2016). Terrorist Attacks Targeting Critical Infrastructure in the United States, 1970–2015. College Park, MD: START.
Another random document with
no related content on Scribd:
rafforzassero in vece il carattere e sollecitassero l’ingegno alle
imprese memorabili?»
Dai libri di poesia, ch’egli continuamente leggeva, saliva al suo
cervello, come un profumo inebriante, il culto fanatico, la
glorificazione, l’apoteosi della grande passione, che l’Arte ha
generato e cui l’Arte filialmente venera. Per quei poeti, gente nobile
e illustre, l’Amore era tutto: era l’armonia dell’universo, la fiaccola del
genio, era la gioja, era l’ideale, era la divinità. Senza l’Amore, il
mondo non aveva più sole; senza l’Amore, la pace, la gloria, le
ricchezze, la stessa fede non eran se non parole vuote di senso,
ornamenti derisorii gittati sopra un corpo piagato e difforme. —
Perchè vivere se non per amare? — si chiedevan quei poeti,
volgendo in torno gli sguardi assetati di felicità. E il cuore del giovine
ripeteva profondamente, come un’eco fedele: «Perchè, perchè
vivere se non per amare?»
In quegli ultimi giorni, ispirato da quelle voci fascinevoli, sospinto dal
pensiero che l’altro stava per ritornare, Aurelio divenne ardito,
risoluto, intraprendente, non trascurando mezzo alcuno a fin di
raggiungere il suo scopo nel termine prefisso. Ormai nessuna
incertezza rimaneva in lui su quanto avrebbe dovuto fare per
costringere Flavia a una risposta sincera e decisiva: occorreva
parlarle a cuore aperto, dichiararle senza ambagi il suo sentimento,
chiederle con lealtà se lo potesse ella, ora o in un giorno non
lontano, contraccambiare; bisognava abbandonare i piani lenti e
astuti per appigliarsi alle risoluzioni rapide ed energiche. Ma come
trovarla sola? Con qual pretesto domandarle un colloquio in
disparte? Ed era forse possibile ottenere un risultato da una
conversazione a bassa voce in cospetto delle altre donne?
La migliore occasione per trovarla sola era irremissibilmente
sfumata. Dal giorno, in cui egli s’era spinto fino al sommo della
pineta, Luisa aveva pregato la zia di trasportarle l’esercizio di
pianoforte alla mattina, e non aveva più lasciato Flavia durante
l’intero pomeriggio. Aurelio, risalito là per ben due volte pien di
speranza, aveva dovuto ritornarsene deluso e scorato in palazzo,
dopo aver passato un’ora di supplizio ineffabile accanto alle due
giovinette.
Egli procurò dunque di farsi intendere da lei a sguardi, a reticenze,
ad allusioni velate durante i ritrovi comuni sul rialto; si diede a
corteggiarla nettamente e volgarmente, sedendole con ostentazione
sempre vicino, cercando di trascinarla per gradi ad appartarsi dal
crocchio, a discorrere con lui solo di cose intime, discrete,
confidenziali. Più volte, nella mezz’ombra dei crepuscoli caduchi,
sdrajato al suo fianco su l’erba dello scalere, egli, approfittando d’un
momento opportuno, riuscì a parlarle del mutamento avvenuto in lui
negli ultimi tempi e ad accennarle i suoi nuovi desiderii; anche tentò,
con qualche inchiesta astuta, d’investigare a fondo nel mistero della
sua sensibilità. Ma le presenze estranee esercitavan pur sempre sul
suo spirito una bizzarra influenza: egli, per sottrarsi alla loro
soggezione, doveva dare alle sue frasi sentimentali un tono fatuo e
giocoso; egli doveva discorrere scherzando, a similitudine d’un
balbuziente che, per vincere la difficoltà di parola, bisogna che canti.
Flavia, d’altra parte, pareva che si prestasse amabilmente a quel
giuoco: lo ascoltava con visibile piacere, e gli rispondeva a tratti
ridendo, schermendosi dalle celie con altre celie più leggere.
— Via, signor Aurelio, — gli diceva talvolta, oppressa dalla sua
insistenza: — sarebbe tempo di finirla con questa burla. Io non
posso credere a una sola dalle sue parole. Non posso credere
ch’ella parli da senno; e, le confesso, non mi garba d’esser burlata.
— Ma io parlo da senno, signorina, — egli affermava, cercando
d’atteggiare il viso a una espressione più seria.
— Lei? con le sue idee? con il suo orgoglio? con le sue belle
opinioni su le donne?... Ma mi stima dunque così ingenua e,
diciamolo pure, così sciocca da credere cecamente a tutto quanto mi
si racconta? Ella, caro signore, vuol divertirsi un poco alle mie spalle;
ma io, benchè non sia che un povero essere inferiore, ho però
almeno tanta intelligenza quanta ne occorre per intenderlo.
Altra volta, gli chiedeva anche con voce grave, quasi malinconica:
— Perché mi dice queste cose, signor Aurelio? Se scherza, ha torto
di scherzare. E se parla sul serio, ho torto io d’ascoltarlo.
E il giorno ultimo venne, inaspettato, senza che Aurelio avesse
potuto effettuare anche in minima parte il piano di conquista, che gli
era già sembrato così agevole e d’esito quasi sicuro!
Ritornò il padre Boris, ritornarono gli ospiti, riapparve il pretendente
basso e tarchiato, dalla pelle olivastra e dagli occhiali d’oro. Venne
anche a sera lo Zaldini, più fresco e più giocondo che non mai,
essendo stato chiamato per lettera dall’Imberido in sèguito alle
preghiere insistenti di Luisa.
La comitiva a bastanza numerosa, divisa in tre imbarcazioni, lasciò il
villaggio verso le cinque del pomeriggio per passare la notte a
Baveno ed esser pronta, la mattina dopo per tempo, a intraprender
l’ascensione del monte. In una lancia erano l’ingegnere Boris, il
Siena e le due fanciulle; in un’altra la signora Teresa, sua cognata e
Giorgio Ugenti; e nella terza infine, donna Marta accompagnata da
Camilla, e Aurelio e Luciano ai remi. La vecchia quantunque
indisposta e sofferente, aveva voluto seguire la comitiva almeno fino
a Baveno, dove sarebbe rimasta con la fantesca in aspettazione, per
far ritorno a Cerro insieme con gli altri nella sera successiva.
Una grande tristezza occupò l’anima del giovine durante la lunga
traversata e durante il pranzo interminabile alla tavola rotonda
dell’Hôtel Belle-Vue. Nel silenzio del lago, battuto da un sole
bianchissimo, nella gran sala oblunga, popolata d’Inglesi impassibili
e di Tedeschi ciarlieri, il pensiero di Flavia non lo abbandonò un solo
istante, e la presenza del rivale, sempre accanto a lei, non cessò di
martoriarlo, come un cancro ostinato che gli rodesse il cuore. In
vano lo Zaldini tentò più volte di farlo sorridere con le sue storielle e
il racconto grottesco d’una sua recente avventura d’amore; Aurelio
rimase pertinacemente muto e grave, finchè questi, tediato dalla sua
indifferenza, si risolvette a volgergli le spalle e ad appiccar discorso
con un vecchio signore inglese, suo vicino di mensa. Ora Luciano
chiacchierava allegramente e senza ritegni con il nuovo suo amico,
decantando nel più pretto idioma britannico la bellezza
incomparabile delle misses e l’eccellenza del gin e del whisky come
eccitanti delle più pazze fantasie.
— Io, se per avventura m’ammoglierò, — diceva lo Zaldini a voce
alta, — sarà senza dubbio con una signorina del vostro felice paese,
perchè adoro il biondo dei capelli e delle sterline. E voglio, la sera
delle nozze, rinnovare il celebre aneddoto del campanello elettrico,
che voi probabilmente conoscete, poichè l’eroe ne fu un vostro
compatriota, anonimo ma non per questo meno degno di memoria...
Il vecchio accennava di no col capo, incoraggiandolo a continuare
con un’occhiata piena di curiosità lasciva. E il giovine infatti, senza
farsi pregare, raccontava l’aneddoto salace, piegando il capo verso
di lui, soffiandogli le parole fioche all’orecchio, scoppiando a tratti in
una risata sonora, che trasfigurava per incanto il viso terreo e severo
dell’ascoltatore.
Nulla irritava di più lo spirito ansioso dell’Imberido che il cicaleccio
frivolo e ininterrotto de’ suoi due vicini. A intervalli, tra lo strepito
dell’acciottolìo e delle conversazioni diffuso per la vasta sala,
giungeva a lui, come un avvertimento di sventura, la voce fessa e
nasale dell’avvocato, seduto al fianco di Flavia a quattro posti in
distanza dal suo. Egli, roso dalla gelosia, aguzzava l’udito a quel
suono sgradevole, che pareva per poco dominare ogni altro romore;
a volte, credeva di comprendere qualche frase inconcludente,
un’affermazione, un ringraziamento, il nome dell’amata proferito
dalle labbra odiose; ratteneva profondamente il respiro per afferrare
il senso dell’intero discorso. Ma uno scroscio d’ilarità si levava
d’improvviso presso di lui, e tosto la voce si disperdeva nel clamore,
vinta e soffocata.
Aurelio doveva fare un enorme sforzo di volontà per contenere il suo
dispetto contro l’amico e vincere l’impulso cieco di levarsi in piedi e
allontanarsi da quella sedia di tortura. Almeno gli fosse toccato in
sorte un posto di fronte a Flavia e al rivale! Avrebbe potuto scrutarli,
spiare i loro movimenti, i loro sguardi, le loro espressioni! Avrebbe
potuto leggere su le loro facce il sentimento che li occupava! In vece,
da quel posto, non gli era dato nè di vederli nè d’ascoltarli! Egli,
anche sporgendo il capo in avanti, non riusciva a scorgere se non le
loro mani, così prossime che parevan toccarsi, così mobili nella
comune bisogna, che tal volta egli non sapeva distinguere le une
dalle altre!...
Dopo il pranzo, la comitiva uscì dall’albergo per fare una breve
passeggiata prima di coricarsi, e si diresse a piccoli gruppi verso
Stresa su la gran via provinciale che costeggia il lago fino ad Arona.
Il vespero era chiaro, pallido, còrso come da un brivido voluttuoso. I
vasti boschi di castagni, che avvolgono le falde del Motterone,
piovevano su la strada polverosa una frescura umida, un profumo
penetrante di terra e di vegetazione. Dal lago, a pena increspato
presso le rive, saliva un odor caldo di pesci e d’erbe fracide. L’isola
Superiore, sola su le nebbie delle lontananze, spiccava nitida dalle
acque, con le sue case fitte e inghirlandate, con il bianco campanile
della chiesuola acuminato verso il cielo, come un ideale.
Le donne procedevano insieme; poi venivan gli uomini in due file: il
Boris d’avanti tra l’Ugenti e il Siena; e Aurelio e Luciano in coda.
Luisa, accanto a Flavia, accennava a mezza voce,
malinconicamente, l’aria preferita del Faust; donna Marta, eccitata
dalla novità del luogo e dalla compagnia numerosa, parlava forte,
con animazione quasi febbrile, al braccio della signora Teresa e della
sorella dell’ingegnere.
L’Imberido, che si sentiva più calmo e come rassicurato, domandò
sorridendo all’amico:
— Perchè hai tardato tanto a ritornare a Cerro? Hai dunque sùbito
dimenticato la signorina Luisa e i tuoi entusiasmi sentimentali per
lei?
— Dimenticata? non del tutto. Ma, che vuoi? appena giunto a Milano
fui travolto in quell’avventura eroica, che t’ho narrata e tu non hai
avuto la bontà d’apprezzare. Ho corso due volte serio pericolo di
vita; ho passato intere ore rinchiuso in un armadio, come un vecchio
soprabito; ho visto un marito passarmi d’innanzi col lume in una
mano e un’enorme mazza ferrata nell’altra. Capirai: le commozioni
violente esercitano una certa influenza su la memoria: ed io per il
momento ho scordato la bionda incantatrice e l’innocente idillio
campagnuolo. Però, come vedi, al solo nome di lei apparso in una
tua lettera d’invito, io non ho esitato a lasciar Milano, ed ora sono
qui. Che puoi pretendere di più dalla mia fedeltà?
— E... come hai trovato Luisa al tuo ritorno? — ridomandò Aurelio
con ironia.
— Ah, per questo, mutata, molto mutata! Forse, te lo confesso, mi
son lasciato troppo desiderare. Ma... e tu, tu come te la sei passata
in questi due mesi di convivenza con l’altra, con la bruna, nel
palazzo fatato, tra i boschi maravigliosi? Sarei curioso d’accogliere
oggi le tue confidenze: credo che ne sentirei di carine. L’eremita mi
ha l’aria d’essersi fatto diavolo. M’inganno?
— Assolutamente, — rispose sicuro l’Imberido, fissando gli occhi a
terra. — La signorina Boris è in teneri rapporti con quel signore dagli
occhiali d’oro, che ci precede. Si parla anzi d’un prossimo
matrimonio con lui.
Lo Zaldini parve molto maravigliato dalla notizia.
— Davvero? Ma ella sarebbe fortunatissima, caro mio! — egli
esclamò. — Io conosco il Siena da molti anni. È un giovine
coltissimo e simpaticissimo! Uno degli avvocati più apprezzati e
meglio retribuiti di Milano! E poi, è molto ricco: figùrati che ha
ereditato, or non è un anno, cinquecento mila lire da uno zio di
Ferrara. E sua madre è nata di casa Orbetello, figlia del celebre
banchiere di Roma, arcimilionario. Se è vero quanto mi racconti, la
signorina Boris fa uno dei più splendidi matrimonii che si possano
imaginare.
Aurelio ascoltò, contenendosi a stento, l’elogio del rivale aborrito,
detto senza malizia da una bocca fraterna. Non ebbe un gesto di
protesta; non una contrazione di spasimo, non un tremito delle mani,
non un battito delle palpebre. Ammutolì, si fece smorto in viso,
sentendo penetrare nel cuore a una a una le parole dell’amico, come
trafitture di spillo. Gli parve che tutto crollasse intorno a lui. Gli parve
di udire la sua condanna mortale pronunciata da un giudice
inappellabile. — Che valeva omai resistere? Che valeva lottare? A
che servivan la sua ostinazione e il suo orgoglio? Costui era il
preferito, era il vittorioso, era il più forte. Costui era l’invincibile,
d’avanti al quale bisognava per necessità cedere o soccombere.
Una divina speranza si spegneva, troncata da quelle affermazioni,
irreparabilmente. La luce non era più luce, la vita non era più vita!
Nel ritorno egli non parlò più.
Scendeva la sera e il vento aumentava su la montagna oscurata.
Dalla gola di Mergozzo, già invasa dalle tenebre, venivano a
intervalli i soffii striduli e subitanei, si riversavano scrosciando su le
acque, giungevan senza freni alla terra, e quivi, irritati dall’ostacolo,
imperversavano contro la foresta, che si piegava e si torceva con un
fragor formidabile di ruina. E l’anima del giovine avvizzita e divelta
dal dolore, pareva seguire travolta il cammino della corrente aerea,
anelando alla distruzione, alla dispersione, all’annientamento totale
di sè stessa, tra il folto di quegli alberi conquassati, verso le
lontananze misteriose, dove le raffiche ululando s’inabissavano.
La notte era ancora profonda, quando la comitiva lasciò l’albergo e
s’incamminò al lume fioco delle lanterne su per le falde boscose del
monte. Durante un lungo tratto nessuno parlò per il calle aspro e
angusto, serpeggiante sotto la verzura profonda: procedettero tutti,
uno dietro l’altro, in silenzio, ancora un poco ottusi dal sonno
bruscamente interrotto, intenti con gli sguardi al suolo, che le
sporgenze delle radici e delle rocce rendevano insidioso. A metà
della selva per la prima volta riposarono: le donne più affaticate
sedettero su i macigni o su l’erba, gli uomini rimasero in piedi vicino
a esse, in aspettazione.
L’aria era fresca e ancor buja: il vento, alquanto scemato di forza,
stormiva tra le fronde, spostando i brani di cielo visibili in cui
palpitavano gli astri. Verso l’oriente l’azzurro incominciava a
impallidire.
Si scambiarono poche parole durante la sosta, che fu assai breve: le
signore, assalite dai brividi, si lamentarono del freddo e sollecitarono
la partenza. Ripresero tutti insieme il cammino, nel medesimo ordine
di pocanzi, con la stessa svogliatezza muta, con una maggiore
preoccupazione del terreno. Man mano che salivano, il sentiero si
faceva più ripido e più scabro, l’ànsito dei viandanti, più frequente e
più grave. E il bosco si diradava, e i castagni immiserivano tra la
ghiaja, e il cielo costellato si schiudeva più libero sopra le loro teste.
Si udiva solo, nel silenzio antelucano, il ticchettare monotono dei
passi contro le pietre mobili del calle, si scorgeva omai là, lontano
sotto di loro, il lago, simile a una vasta distesa di pece brunastra,
simile a un immane stagno limaccioso in mezzo alle incerte forme
delle montuosità.
La comitiva, un poco avvivata dall’aria più leggera, giunse al confine
della selva e in vista della vetta, quando l’alba imperlava già
l’orizzonte sopra i colli di Lombardia. Gli ultimi alberi crescevano sul
ciglio d’uno sprone scosceso, al sommo del quale l’erta d’un tratto
s’addolcisce larghe praterie irrigue s’incurvano mollemente,
appoggiate a una tenue concavità e quindi al pendìo terrigno del
monte. Nel chiaror livido dell’ora, quei prati avevano una tinta cupa e
unita, d’una inimitabile morbidezza; e qua e là, di tra l’erbe,
balenavano foscamente le grandi pozze degli abbeveratoi o
spiccavano le macchie nere delle stalle e delle capanne pastorizie.
Un tintinnìo languido di campani e qualche sordo muggito venivan
dall’alto, dove una mandria usciva in quel punto per il pascolo.
Come la viottola si stendeva più larga e più agevole, la comitiva
ruppe per ragunarsi l’ordine primiero di marcia, e le conversazioni
non tardarono ad accendersi. Camminavano tra i prati, quasi su un
piano, disposti in due schiere, stretti gli uni agli altri, rinvigoriti e
imbaldanziti dalla brezza e dalla vision della mèta. L’Ugenti e lo
Zaldini apparivano allegrissimi, e gareggiavano in dir motti e
sciocchezze, che sollevavan l’ilarità delle quattro donne; e il Siena a
volte li secondava, con la sua flemma mordace e quasi maligna. Ma
Aurelio seguiva astratto e taciturno i compagni, volgendo gli occhi
inquieti su la severa maestà del paesaggio.
Era in lui, dal momento in cui aveva lasciato l’albergo, una
perplessità strana e confusa, che era andata a grado a grado
addensandosi fino a opprimerlo come un’angoscia. Aveva passato
una notte insonne, sprofondando gli sguardi nel vortice della sua
infelicità; aveva sentito più volte morire le sue speranze e risuscitare
per novamente morire; aveva singhiozzato come pazzo nelle
tenebre, immemore dell’amico che dormiva tranquillamente accanto
a lui. Ma poi, quasi per un prodigio, appena su la via, ogni triste
ricordo s’era spento, ogni doloroso residuo erasi dileguato nel suo
pensiero; ed egli era caduto in una specie di torbida incoscienza
animale, rotta da fuggevoli proponimenti e da incerte fantasie. Ora
egli seguiva i compagni astratto e taciturno, occupato tutto da un
pensiero ignoto, da un’ignota volontà, da un’intenzione che rimaneva
occulta nei recessi impenetrabili dell’essere.
Il pianoro fu ben presto attraversato. Il calle per giungere alla cima si
drizzò più arduo che non mai, lungo il dorso eretto, sdrucciolevole
per le infiltrazioni delle acque, che costituisce la mole centrale della
montagna. La comitiva dovette sbandarsi di nuovo, e ciascuno
separatamente intraprese l’ultima ascensione, chi seguendo il
cammino più comodo tra i margini del sentiere, chi cercando il
tramite più diretto su le zolle madide del prato.
Un superbo spettacolo si svolse frattanto, da ogni parte, intorno a
loro. La luce aumentò con rapidità, come regolata da una mano
impaziente: l’erbe splendettero, si copersero d’innumerevoli fiori; le
pozze degli abbeveratoi si rischiararono; le stalle e le capanne
pastorizie spiccarono con le loro forme pittoresche tra il verde
uniforme delle praterie. Di qua e di là, su la frescura dei pascoli,
apparvero distintamente le mandrie e i greggi, che si udivan prima
tintinnare, muggire e belare nell’ombra. Quando il chiarore si diffuse
più crudo, le catene dei monti, abbraccianti il Verbano, si fecero tutte
palesi nella loro ricca vegetazione fino alle estreme punte
settentrionali, si propagarono come un’immensa successione di
gigantesche onde impietrite rimaste a vestigio d’una qualche
primordiale fluttuazione tellurica. E, in basso, il lago opaco e inerte si
mostrò lucido e bianco nell’alba, simile a un bel fiume di latte, simile
a una favolosa lama d’argento piombata dall’alto e affondatasi per la
sua gravità nelle onde della terra molle.
In fine l’aurora venne a tinger di rosa l’orizzonte lontano. Sul monte
Nudo, sul Sasso del Ferro, su i colli di Mombello, lungo la linea quasi
diritta delle campagne d’Ispra e di Ranco, una zona di luce rancia si
prolungò in guisa d’un nastro serico che orlasse per vaghezza i
capricci del litorale. Quasi sùbito, alcune strisce di vapori si formaron
per incanto nell’aria pura; parvero imbeversi, come spugne, delle
tinte calde dell’aurora; s’accesero, fiammeggiarono preannunziando
l’avvento glorioso del sole. E questo maravigliosamente comparve,
fuor del dosso precipitoso che incombe sopra Laveno, prima come
un punto incandescente e poi come una gran bolla di fuoco espressa
dalle viscere del monte. Le vette s’imporporarono; i raggi discesero a
grado a grado per le chine, cospargendole d’oro; avvolsero in una
nebbia adamantina le falde boscose; s’infransero in ultimo su la
superficie delle acque, provocando nell’urto l’accensione subitanea
d’infinite scintille.
Il nuovo giorno era fatto. Le campane dei villaggi squillarono a festa,
in segno di saluto.
La comitiva fu sbandata e dispersa dalle difficoltà sempre crescenti
dell’ascesa. I più giovini e i più validi, procedendo lunghesso i prati,
s’allontanarono dagli altri che rimasero in basso, trattenuti
dall’affanno e dal calore. L’Ugenti e lo Zaldini, offrendo le mani a
Luisa, trascinandola a forza su per l’erta, scomparvero primi alla
vista dei compagni in una valluccia angusta, avvivata da un ruscello
garrulo e schiumeggiante. Il Siena più cortese restò sul sentiere
tortuoso con la signora Boris, l’ingegnere e sua sorella, per
soccorrerli nei passi disagevoli. Aurelio e Flavia si trovarono d’un
tratto soli e liberi, come smarriti nel monte deserto, su una piccola
prominenza erbosa a metà della china.
Quando il giovine se n’avvide, volgendo gli occhi in torno, ebbe un
sussulto improvviso e violento in tutto l’essere. — Flavia era là,
d’avanti a lui, come in quel giorno lontano sul minuscolo prato al
sommo della pineta! Ella saliva pianamente per quella distesa
inclinata, tra l’intonsa verzura, lasciando dietro di sè un mobile solco
di fili prosternati. Portava ancora, come in quel giorno, l’abito grigio,
attillato, senza guarnizioni, che una cintura d’un color di lilla pallido
avvinceva strettamente sopra i fianchi sobrii e a pena arcuati. E
recava in testa il cappellaccio di paglia dalle tese larghe e convesse,
su cui risaltavan due tulipani sanguigni in un ciuffo di foglie e di
spiche.
Oh, le memorie, le memorie! — Aurelio si volse, fissò gli sguardi
laggiù verso il lago, all’opposta riviera dove biancheggiava il villaggio
solitario. Era là, sotto di lui, remotissima, la pineta del palazzo, simile
a un ammasso di cose oscure, indefinibili; era là il luogo nascosto e
favorevole, dov’ella aveva per la prima volta incantato la natura e la
sua anima. Ancora ella lo incantava; ancora e più, ella con la sua
grazia annobiliva e irraggiava le apparenze per mezzo a cui
passava. Eretta su lo sfondo verde e fiorito, come in quel giorno
lontano, ella era simile a un’imagine immortale e immutabile. Anche
una volta il giovine, contemplandola, non vide in lei la fanciulla
ch’egli ben conosceva: vide l’arbitra del suo destino mortale, la
custode della sua felicità, l’incarnazione portentosa del suo più
schietto Sogno di giovinezza; vide l’Unica che avrebbe potuto far di
lui un essere giojoso.
Con un impeto subitaneo, come spinto a tergo da una forza
esteriore, accelerò il passo sul pendìo; e, giunto presso colei che lo
precedeva, disse:
— Flavia, m’ascolti. È la prima volta, dopo molti giorni, che ci
troviamo soli. Io ho passato due settimane di tortura ineffabile,
cercando un mezzo per poterle liberamente parlare..... Oggi
finalmente il caso mi ha favorito.... Ho bisogno di farle una
confessione assai grave e di chiederle un consiglio.
— A me? — ella domandò con un accento ambiguo, d’incredulità e
d’ironia, volgendo a pena il viso verso di lui.
— A lei, Flavia, a nessun altri che a lei.
Poi, dopo una pausa in cui parve ch’egli ascoltasse i palpiti
accelerati del suo cuore, soggiunse:
— Ella mi troverà molto mutato; si stupirà del mio cambiamento
radicale da un mese a questa parte. Io non ne ho colpa alcuna; ho
fatto il possibile, signorina, per soffocare i nuovi desiderii e le nuove
commozioni del mio spirito, per esser forte, per riprendermi e per
dominarmi. Tutto fu inutile. Dirò meglio: ogni sforzo della mia volontà
ribelle non riuscì che ad accrescere i miei turbamenti e le mie
angosce. Io sento oggi che una sola via di salvezza mi rimane:
quella di rivolgermi con tutta franchezza a lei, e di rimettere
fiduciosamente nelle sue mani il destino della mia vita.
— Mio Dio! — esclamò la fanciulla, tentando di sorridere. — È una
responsabilità troppo grave ch’ella mi vuole addossare! Io non credo
d’esser da tanto, signor Aurelio.
Il viso del giovine si coprì di pallore; le sue mani tremarono; i suoi
occhi si volsero inquieti in torno, come se un passo estraneo fosse
risonato d’improvviso dietro di lui.
— Per carità, Flavia, non rida, non scherzi! — egli riprese a dire,
rassicurato dalla solitudine; — ella deve comprendere ch’io parlo ora
con tutta l’anima mia; ella da molto tempo deve aver compreso ch’io
la cerco, ch’io la seguo, ch’io non perdo un’occasione di potermi
avvicinare a lei. Ricorda, Flavia, quel giorno che son salito lassù,
sapendo di trovarla sola, e l’ho interrogata? Ricorda il mio sgomento,
la confusione delle mie parole? Ricorda bene la mia ultima
domanda? Già fin d’allora avrei voluto confidarmi a lei interamente....
Era salito per questo, ella deve averlo compreso... E m’ha dato una
risposta così fredda, così crudele!
Ella, che sempre camminava, sorrise.
— Crudele, ma meritata, — mormorò con un fil di voce, senza levar
gli sguardi dal prato.
— No, meritata, no. Forse, prima; ma poi, poi.... e in quel momento!..
Ebbene, Flavia, ella non sa, non può sapere quanto io ne soffersi.
Ella non sa ch’io ho passato giorni e notti intere, meditando quella
risposta, analizzandola, rivolgendola dentro di me, cercando sotto le
parole i sentimenti che potevano averla dettata.
— E perchè? — ella domandò, interrompendo, con un tono forte di
voce e un atto superbo della testa, che diedero al semplice motto
una significazione profonda.
Egli anche si eresse; egli anche per poco la fissò, sicuramente. Ma
lo sguardo di lei dal basso in alto, uno sguardo armato, turbinoso,
pieno di mistero, lo vinse, obbligandolo ben tosto a distoglier di
nuovo gli occhi dal suo viso. Egli rispose dunque, umilmente, a capo
chino:
— Perchè io l’amo, signorina Flavia.
La fanciulla non si scosse alla grande confessione. Si fermò, in
aspetto indifferente, e mormorò dopo una pausa, abbassando le
palpebre:
— Fermiamoci qui. Aspettiamo gli altri.
— Oh, Flavia! Flavia! — proruppe egli con impeto, irritato da quella
freddezza, esaltato dalla sua audacia, deciso a combattere fino
all’estremo. — Ella non mi risponde? Non ha nulla da dirmi, almeno
per cuore, per pietà? Ella mi respinge dunque così....?!
— No, io non la respingo, — disse Flavia tranquillamente, rimanendo
ritta di fronte a lui. — Non è ch’io la respinga. M’aveva chiesto un
consiglio, e volevo pensare coscienziosamente prima di risponderle,
appunto perchè le sue parole m’hanno colpita e il suo sentimento
non mi può che insuperbire. Essere prescelta da lei, nobile,
intelligente, coltissimo: è certo l’ideale sognato da una donna. Ma io
ho sofferto, signor Aurelio; le tristi vicende della vita m’hanno resa
cauta e diffidente.... Io so, io sento che, secondando l’impulso
momentaneo, preparerei la mia, la nostra sventura avvenire... E
questo non voglio.
— Oh, Flavia....
— Ricordo bene le sue parole, — ella continuò, senz’interrompersi,
con un accento vibrato e sicuro, sempre ritta, sempre immobile di
fronte a lui. — «L’uomo deve rimaner solo, libero, senza impegni,
senza legami, se vuol riuscire nel suo intento, se vuol vincere e
dominare.... L’amore è un’umiliazione... La donna è una ruina, un
essere inferiore che affascina e che distrugge!...» Ella vede, Aurelio,
io le ricordo tutte; e le ricordo perchè le ho a lungo considerate e
meditate. Ho creduto allora a lei, come credo adesso; ma devo alle
prime parole prestare una fede maggiore, perchè quelle eran dette
pacatamente, risolutamente, senza influenza di commozione o di
sentimentalità. Ora, pensi, pensi, Aurelio: come potrei, con la
memoria lucidissima delle sue massime sconfortanti, abbandonarmi,
spensierata e fiduciosa, all’illusione presente, al fascino ingannevole
d’un sentimento, che in lei non può durare?...
— Oh, Flavia, ella dubita di me? — egli chiese, con la voce strozzata
dall’affanno.
— Dio me ne guardi! Ma anche lei oggi si illude; anche lei s’inganna,
in preda a un’esaltazione passaggera, che basterà la più piccola
contrarietà a calmare e a disperdere.... Se io poi le intralciassi il
cammino? Se io potessi un giorno esserle d’ingombro? Se in
avvenire le dovessi costare il sacrificio de’ suoi ideali e delle sue
giuste ambizioni? Ella avrebbe pure il diritto di rimproverarmi questo
momento di debolezza e di malintesa condiscendenza; ed io avrei
segnata per sempre la mia condanna!
— Le mie ambizioni! — egli esclamò, con doloroso sarcasmo. — I
miei ideali! Io non rammento più neppure d’averli sognati!...
— E questo è appunto ciò che più mi sgomenta. Perché un giorno
ella potrà dire con uguale sincerità: «Il mio amore! Io non ricordo più
neppure d’averlo supposto!» E in quel giorno, gli ideali e le ambizioni
si saranno di nuovo impadroniti di tutta la sua anima, come e forse
più che in passato!... Ah, no, no, rifletta bene, signor Aurelio: è
impossibile, impossibile! A lei è riserbato un avvenire di gloria, ben
diverso dal mio. Ella deve restar solo. Alle sue idee predilette, alle
grandi battaglie della vita, ella deve consacrare tutto quello che v’ha
di alto, di buono, di nobile nel suo intelletto e nel suo cuore.
Solamente così potrà vedere giorni felici; poichè il sogno, che ella ha
accarezzato dai primi anni di sua giovinezza, è ben di quelli che si
realizzano o rendono intollerabile qualunque altra realità.
Ella parlava con una tale sicurezza e una tal limpidità, che le sue
affermazioni assumevano su l’animo dell’ascoltatore un’irresistibile
virtù persuasiva. Egli non osava più interromperla; egli la guardava
con un’indicibile angoscia, sentendo a poco a poco passare
nell’anima sua le idee ch’ella gli veniva esponendo e impossessarsi
contro ogni volontà della sua ragione. E vedeva l’ostacolo crescere
tra loro, salire a mano a mano come una nebbia densa, dividerli per
sempre e respingerli indietro, sempre più indietro, verso due plaghe
remote, inaccessibili l’una per l’altra.
— Pensi poi al mio passato, al mio tristissimo passato, signor
Aurelio! Esso pesa sopra di noi non meno grave del suo lieto
avvenire. Pensi alla delusione, ch’io ho sofferta e m’ha distrutto ogni
ingenuità del cuore, ogni fede, ogni entusiasmo! Che cosa potrei
darle io oggi, in cambio del suo affetto? Un povero fiore, sì, ancora,
ma senza profumo e che la bufera ha già fatto baciar la terra!.. Ella
vede dunque: è meglio, è necessario per entrambi che questa follìa
non continui. Lasciamoci da buoni amici, che si conoscono e si
stimano. E proseguiamo senza rimpianti le nostre due vie, che son
diverse e non possono confondersi. Più tardi, creda, ella penserà a
me con riconoscenza; più tardi mi saprà grado d’essere stata forte e
riflessiva in un momento in cui ella non lo era.
Flavia s’arrestò, calma, pensierosa, un poco triste, e lo fissò negli
occhi intensamente.
— Ella, in cuor suo, già m’approva, non è vero? — chiese, con un
pallido sorriso. — Addio, dunque. E... grazie!
Disse anche, dopo un silenzio:
— Si ricordi di me come d’un’amica sincera, devota, immutabile. Io
non dimenticherò quest’ora della mia vita mai, mai...
E gli stese con un atto franco la mano.
Aurelio, passivo e attonito, la prese nella sua, la strinse con forza.
Si udivan da lontano le risa della bionda echeggiare contro il monte
solitario; si udivan di qua e di là tintinnare i campani delle mandrie e
dei greggi su i pascoli.
Il Sogno pareva disperdersi, e il risveglio era assai desolato. Egli era
solo, senza più una speranza, senza più un’illusione. Egli sentiva
nell’anima la necessità fatale d’esser solo, «per riuscire nel suo
intento, per vincere e dominare.» Qualcuno aveva affermata questa
necessità; ed egli se n’era persuaso. Su, su, sempre più in alto, egli
sarebbe dovuto andare, continuamente andare, portando la croce
della sua sapienza, anelando affaticato alla sommità del suo
Golgota, dove avrebbe trovato ad aspettarlo la Morte. Quale forza
terrena sarebbe riuscita a opporsi a una disposizione superna? «Chi,
chi può dunque mutare il destino?»
Così era e così doveva essere. Le gioje dei mortali non eran per lui,
non eran per quelli che son destinati a sacrificarsi a un Ideale, a
versare il loro sangue più puro per fecondar la terra o per imbevere
le sabbie. Su, su, sempre più in alto, egli avrebbe dovuto andare,
continuamente andare, chiudendo gli occhi agli spettacoli giocondi
della vita, per non morire lungo il cammino d’invidia e di desiderio!
Ma non gli era dunque riserbato un conforto, un unico conforto nella
sua gloriosa sventura? Egli cercò avidamente nel suo cuore se un
conforto esisteva. E l’imagine sparuta della nonna gli sorrise benigna
di tra le tenebre, come la prima e l’ultima dolcezza del suo infinito
abbandono.
X.
Tra l’Amore e la Morte.
La sera del dì successivo l’ingegnere e gli ospiti partirono. Anche

Luisa, richiamata dal padre, dovette lasciare la villa e far ritorno a
Milano in compagnia della sorella Boris. Su la spiaggia donna Marta
e il nipote discesero a salutarli.
Quando le due barche piene, dove avevan preso posto anche Flavia
e sua madre, scomparvero alla vista, la vecchia, ch’era stata prodiga
d’effusioni per tutti e aveva versato anche qualche lacrima
abbracciando la bionda che pure piangeva, ebbe d’improvviso un
colpo di tosse secca, violenta.
— Vedi? Vedi? — le disse Aurelio, impensierito, prendendola sotto il
braccio per ricondurla in palazzo. — Tu oggi dovevi fermarti a letto.
Dopo l’imprudenza di jeri, tu non saresti dovuta alzarti. Prendere
tutta quell’acqua! Arrivare a casa inzuppata come se avessi fatto un
bagno nel lago! E tutto questo, per la tua ostinazione, per non
volermi ascoltare mai, mai!... Non si poteva forse restare un’altra
notte a Baveno? Non si poteva, poiché il tempo minacciava,
rimandare il ritorno a questa mattina? Ma tu, no, tu, come sempre,
hai voluto agire di tua testa; tu hai voluto tentare la traversata,
soltanto perché io ti pregava di non farlo! E, lo sai, io te ne pregava
soltanto per la tua salute.... Ora, vedi? Vedi? Hai la tosse. Ora ti
ammalerai...
— Crepi l’astrologo! — esclamò donna Marta, ridendo.
— Non scherzare, mamma, — proseguì serio e accalorato il giovine:
— quella tosse non mi piace, e bisogna che tu la curi prima che
sopravvenga una qualche complicazione. Alla tua età i mali più
leggeri son sempre pericolosi. Domani in tanto rimarrai a letto. Io
esigo che domani tu rimanga a letto.
— Domani farò quel che mi piacerà.
— No, domani invece farai quel che a me piace, e sarà forse la
prima volta che un caso tanto straordinario accade nella nostra vita.
Donna Marta, ancora commossa dalla scena dei saluti, non era in
vena di discutere e di litigare; e concluse con un sorriso di
compatimento per il nipote:
— Ebbene, domani ne riparleremo.
La mattina dopo; quando Aurelio si presentò nella camera dell’avola,
la ritrovò mezzo vestita d’avanti alla specchiera, in atto di pettinarsi.
Egli ebbe un moto subitaneo d’irritazione che a stento potè
contenere. Le domandò guardandola negli occhi:
— Come? Ti alzi?
Ella rispose:
— Sì, mi alzo.
Ma era più pallida del giorno prima. Era bianca come i suoi capelli,
come la sua camicia. Egli richiese:
— Hai tossito stanotte?
Ella rispose:
— A bastanza. Non ho potuto chiuder occhio fin verso l’alba.
— E ti alzi ugualmente?
— Sì.
— Perchè, mamma? Perchè?
— Perchè lo voglio. Perchè so che, se rimango a letto un giorno, non
mi rialzo più.
— Che sciocchezza!... Del resto, se farai così, quando ti deciderai
infine a rimanervi, sarà troppo tardi e forzatamente il tuo triste
presagio si avvererà.
Egli si avvicinò a lei, la baciò su i capelli, le disse con la voce più
dolce, implorando:
— Sii buona: ritorna a letto, mamma! Ascoltami!
— Non seccarmi! — ella proruppe d’un tratto, irosa. — Non ho voglia
d’esser seccata, stamane! Lo vedi, non mi sento bene! Mi sembra
d’avere il cuore sospeso a un filo! È una crudeltà questa tua di farmi
arrabbiare nello stato in cui sono! Vattene via! Lasciami in pace!
Aurelio comprese ch’era inutile insistere. Uscì dalla camera di donna
Marta, inseguito da un presentimento sinistro. Come fu solo su la
loggia, sentì gli occhi bruciare e inumidirsi; mandò un gran sospiro di
rassegnazione desolata. «Mio Dio! Quanto era pallida! Quanto era
breve la sua respirazione! Se mi morisse?!» egli pensò, trasalendo,
affondando per un attimo paurosamente gli sguardi nell’avvenire.
Durante la colazione, donna Marta si mostrò vivace, ciarliera,
oltremodo allegra, di quella sua allegria nervosa e scomposta che
ricordava un poco l’eccitazione d’un ebro. Domandò con insistenza
al nipote i particolari dell’ascensione, alla quale era stata afflittissima
di non poter prender parte; discorse a lungo dei vicini, profondendosi
in elogi e in attestazioni di simpatia per essi; lo rassicurò anche a più
riprese su la sua salute, affermando che in verità ella non si sentiva
nè meglio nè peggio di prima. Quanto a quel po’ di tosse, càspita,
non c’era proprio di che impensierirsi: ella aveva già ordinato a
Laveno certe polveri miracolose, le quali senza dubbio ne
l’avrebbero liberata in due o tre giorni al più tardi.
— E se non ostante le tue polveri, la tosse continuasse? — chiese
Aurelio, sempre serio, sempre più triste quanto ella si dimostrava più
gaja.
— Non temere: passerà.
— E se non passasse? Due o tre giorni senza cure posson esser
causa di complicazioni anche molto serie, che oggi si riuscirebbe
senza difficoltà a evitare. Pensaci! Vuoi che vada io a Laveno per
chiamare il medico?
— Il medico? Guàrdati bene! Io non voglio saperne di medici! Non
ne ho mai voluto sapere! E poi, ora, non è il caso neppur di parlarne.
Si tratta probabilmente d’un semplice raffreddore; e tu, al solito,
esageri....
Finita la colazione, il giovine uscì dal palazzo, sedette al sole sul
rialto, invaso da una strana malinconia, da un’ansietà inesplicabile.
Erano i residui del colloquio definitivo avuto con Flavia su la
montagna, che gli infondevan quella cupa tristezza? No; gli
avvenimenti di due giorni innanzi gli sembravano irreali e
lontanissimi. Sentiva anzi una discontinuità profonda tra lui e il suo
essere anteriore, tra quel che era stato e quel che era. Le sue
speranze distrutte, il suo amore respinto, la coscienza del suo
avverso destino lo lasciavano freddo e impassibile, com’esse non
riguardassero più la sua persona, ma bensì un’altra ch’egli aveva già
amata ed ora a pena ricordava. Che gli importava di Flavia? Che
parte rappresentava ella nella sua vita? Che conforto avrebbe egli
potuto trarre anche dalla speranza d’essere amato da lei? Ohimè,
nell’ora presente, nessun conforto, nessuno! Altre cure, e più gravi,
assai più gravi, occupavano omai tutto il suo spirito: altri dubbii, altri
pensieri, altri sentimenti. Quali? Egli non sapeva bene e non cercava
di sapere. Egli aveva paura di inoltrarsi nel mistero del suo
accasciamento; provava orrore solo a rivolgervi di sfuggita gli occhi
dell’anima; evitava d’investigarsi, per la tema di precisare il
fantasma, d’udire in fondo a sè l’eco d’una tremenda profezia.
Il sole, un sole autunnale senza forza e senza vita, slargava i suoi
raggi pallidi e velati sul prospetto del palazzo. Qua e là nel cielo
alcuni fiocchi bianchicci di vapore intorbidivano l’azzurro,
oscurandosi e addensandosi verso la pianura. Un silenzio di morte
teneva la spiaggia deserta, dove le barche s’allineavano in disordine,
immobili e abbandonate come carcasse respinte dall’onda.

Critical Infrastructure Resilience and Sustainability Reader Ted G Lewis Full Chapter

Uploaded by

Copyright:

Available Formats

Critical Infrastructure Resilience and Sustainability Reader Ted G Lewis Full Chapter

Uploaded by

Document Information

Original Title

Copyright

Available Formats

Share this document

Share or Embed Document

Sharing Options

Did you find this document useful?

Is this content inappropriate?

Copyright:

Available Formats

Critical Infrastructure Resilience and Sustainability Reader Ted G Lewis Full Chapter

Uploaded by

Copyright:

Available Formats

Critical Infrastructure Resilience and

Sustainability Reader Ted G. Lewis

Published by John Wiley & Sons, Inc., Hoboken, New Jersey.

Library of Congress Cataloging-­in-­Publication Data applied for:

Cover Design: Wiley

Set in 9.5/12.5pt STIXTwoText by Straive, Pondicherry, India

2.2.4 Paradox of Redundancy (POR) 43

4 The Vulnerable Powergrid 73

4.2.1 Grid Structure 77

5 Water and Water Treatment 97

6 Transportation Renewed 114

7 Supply Chains 137

8 Communications and the Internet 154

8.2.2 The First (Modern) Critical Infrastructure 159

9 Cyber Threats 186

9.2.8 Trojans, Worms, Viruses, and Keyloggers 202

10 Social Hacking 209

11 Banking and Finance 228

11.6 The End of Stimulus? 246

12 Strategies for a Changing World 251

1.1 ­The Evolution of Critical Infrastructure Protection

1.1.1 In the Beginning

1.1.2 Natural Disaster Recovery

1.1.3 What Is Critical?

1.1.4 Public–Private Cooperation

1.1.5 Federalism: Whole of Government

Table 1.1 CIKR as defined by PPD-­21 (2013).

Sector Sector-­specific agency

Chemical Department of Homeland Security

1.2 ­Defining CIKR Risk and Resilience

1.2.1 Risk Strategy

1.2.2 Resilience Strategy Normal Collapse Recovery

16 Presidential Policy Directive-21 – Critical Infrastructure Security and Resilience.

1.2.3 Sustainability Strategy

Sustainability: the ability to maintain or support a process continuously over time.

1.2.4 The Four Horsemen

1.3 ­Weather/Climate Change/Global Warming

1) How do we know the Earth is warming up?

1.3.1 The Carrington Event

1.3.2 Black Bodies

Temperature variation since 1880

CO2 strongly correlated with temperature rise

1.4.2 The Report Card

Table 1.3 ASCE report card for 2021. Overall grade

Source: Adapted from [12].

1.4.2.1 The Domino Effect

Number USA attacks on CIKR (1970–2015)

Number USA attacks on CIKR (1970–2015)

1.4.4 Cyber Exploits/Criminals

1.4.4.1 Black Hats

1.4.4.2 Cybercrime Pays

1.4.5 The Soft War

1.4.6 Cyberattacks and CIKR

Growth of cyberattacks on infrastructure

The following are offered as thought-­provoking questions to stimulate discussion.

La sera del dì successivo l’ingegnere e gli ospiti partirono. Anche

You might also like

Library of Congress Cataloging-in-Publication Data applied for:

1.1 The Evolution of Critical Infrastructure Protection

Table 1.1 CIKR as defined by PPD-21 (2013).

Sector Sector-specific agency

1.2 Defining CIKR Risk and Resilience

1.3 Weather/Climate Change/Global Warming

The following are offered as thought-provoking questions to stimulate discussion.