Systems that Should Have Failed: Critical Infrastructure Protection in an Institutionally Fragmented Environment

Recent years have witnessed major governmental initiatives regarding Critical Infrastructure Protection (CIP). At the same time, critical infrastructures have undergone massive institutional restructuring under the headings of privatization, deregulation and liberalization. Little research has gone into understanding the interactions between these two developments. In this article, we outline the consequences of institutional restructuring for the changing ways in which critical infrastructures ensure the reliability and security of their networks and services. Neither Normal Accident Theory nor High-Reliability Theory can account for reliability under these conditions. We then investigate the implications of these findings for Critical Infrastructure Protection (CIP). 1 Protecting critical infrastructures post-restructuring Critical infrastructures are part of a larger set of services and products that are considered essential to the functioning of our modern economies and societies (DHS, 2003a; 2003b; NRC, 2002). An amazingly heterogeneous set of so-called ‘large technical systems’1 providing services and commodities are considered to be vital.2 These include but are not limited to energy, information technology, telecommunications, health care, transportation, water, government and law enforcement, and banking and finance.3 An array of assessments argues that the collapse of services from these systems would be disastrous for whole economies and societies.4 At the core of every list of critical infrastructures are the large-scale technical grids of energy, water, communication and transportation. It is this subset of critical infrastructures on which we primarily focus our attention in this article. Using a somewhat tired, but still apt metaphor, they make up the arteries and veins of Western, urbanized societies (Zimmerman