New center reaches out to private firms to protect infrastructure
A new center dedicated to assessing terrorist threats to critical U.S. infrastructures is reaching out to other institutions to help mitigate the risk of attacks against strategic U.S. industries and government services, according to U.S. officials.
The National Infrastructure Simulation and Analysis Center, or NISAC, located at Sandia National Laboratories in New Mexico, has joined in recent months with the Massachusetts Institute of Technology, Purdue University, Cornell University, Lucent Technologies and Argonne National Laboratory, among others, the officials said recently.
NISAC, which is jointly supported by nearby Los Alamos National Laboratory, is seeking new strategic partners in establishing itself as the primary national facility capable of simulating how catastrophic terrorist attacks could disrupt critical infrastructure, how attacks on one node might affect other elements of national infrastructure and how to recover quickly from such events.
"Right now we are developing the expertise," Steve Rinaldi, NISAC's joint program manager, said in an interview. "As we need information on specific infrastructures, we will collaborate with those organizations, in the government or private sector, that are willing and able to work with us."
The USA Patriot Act of 2001 chartered NISAC, which opened its doors April 1 this year. It is designed as the "source of national competence to address critical infrastructure protection and continuity through support for activities related to counterterrorism, threat assessment and risk mitigation," the legislation says.
The center, which is slated to be transferred from the Energy Department to the proposed Homeland Security Department, should help determine which critical infrastructures-from nuclear and electric power, oil, gas, transportation, water, communications, banking and finance, emergency services, law enforcement, government continuity, agriculture and health services-are most vulnerable to attack.
The simulation and analysis center will also assess how such attacks may affect other infrastructures and outline ways to prevent interdependent nodes from suffering a "cascading effect" following a successful attack. For example, according to Rinaldi, the center will look at how electric utilities rely on natural gas and how an attack on one would likely affect the other.
"NISAC's unique niche is the interdependency piece of the infrastructure," Rinaldi said.
Indeed, government officials have increasingly warned that the interdependency of national infrastructures poses a new strategic threat to national security.
"Disruptions in any one of them could jeopardize the continued operation of the entire infrastructure system," Samuel Varnado, director of infrastructure and information systems at Sandia, told the House Committee on Energy and Commerce's investigations subcommittee in July.
"In the past, the nation's critical infrastructures operated fairly independently," he added. "Today, however, they are increasingly linked, automated, and interdependent. What previously would have been an isolated failure could cascade into a widespread, crippling, multi-infrastructure disruption."
According to Janice Stevens, director of business development for Management Technology, a firm that is discussing a possible partnership with Sandia on nuclear power plant security, a successful attack on today's infrastructure "will cause unacceptable national impacts."
"The events of 9/11 underscored the growing awareness that terrorist groups are far more capable of mounting critical infrastructure attacks within the United States than previously recognized. These groups may be able to coordinate activities among multiple terrorist cells for planning and executing relatively sophisticated attacks."
Officials agree that to determine infrastructure vulnerabilities and to derive mitigation strategies, NISAC needs outside help and private sector expertise in particular.
"We realize the industry is the owners and operators" of much of the critical infrastructure, according to Rinaldi. "They know the assets they have and how they are hooked together. If you want to model you have to know how the networks are put together."
He said NISAC is seeking private firms "for their expertise and their data."
However, private entities are not always willing to divulge what they deem sensitive information and in some cases such reluctance could hold back NISAC's assessment work.
"Help is needed in working with private industry," Varnado told Congress in July. "Many of the private owners of the infrastructure feel that identification of critical nodes and vulnerabilities is sensitive information, and they are reluctant to share it with the government."
He called for government action "to create a process under which sensitive information can be shared among those in government and industry with a need-to-know."
As NISAC develops the capabilities required to conduct the necessary simulations and models, it has set some ambitious goals. With $20 million in fiscal 2002 and more coming for fiscal 2003, Rinaldi said he hopes to provide four "business lines:" policy analysis to help policy-makers develop better risk reduction strategies; mitigation planning that best utilizes limited resources; education and training tools for first responders; and real-time assistance in the event of a major infrastructure attack or disruption.
NISAC is also looking to demonstrate a biological surveillance simulation system that will provide an initial capability to examine movement of disease through mobile urban populations and intervention strategies.
By 2005, "NISAC will be fully functional with advanced modeling and simulation capabilities to provide policy analysis, mitigation planning, education and training support, and real-time crisis assistance for a wide variety of users," according to NISAC literature.