Critical Infrastructure Resilience: The Evolution of Policy and Programs and Issues for Congress

In 2006, the Critical Infrastructure Task Force of the Homeland Security Advisory Council initiated a public policy debate arguing that the government's critical infrastructure policies were focused too much on protecting assets from terrorist attacks and not focused enough on improving the resilience of assets against a variety of threats. According to the Task Force, such a defensive posture was " brittle. " Not all possible targets could be protected and adversaries could find ways to defeat defenses, still leaving the nation having to deal with the consequences. The Task Force advocated that greater encouragement for resilience would broaden the range of risk reduction options and should be the overarching policy framework for reducing risks associated with all threats to critical infrastructure. Others in the homeland security community agreed. Critical infrastructure are those assets the loss of which would result in great harm to the nation's security, economy, health and safety, and morale. They include assets necessary to generate and distribute such basic goods and services such as electricity, drinking water, telecommunications, banking and finance, etc. Resilience refers to the ability of a system to resist, absorb, recover from, or successfully adapt to a change in environment or conditions. The Task Force argued that government policies encouraged employing greater defenses such as surveillance equipment, guards, etc., around these assets but did less to encourage efforts that would allow assets to continue operating at some level, or quickly return to full operation, if attacked. Such efforts might include increasing redundancies (such as having multiple backup power generation capability) or designing more robust systems for the future (such as using more hardened concrete for stronger fixed facilities). In 2008, as part of its oversight function, the House Committee on Homeland Security held a series of hearings addressing resilience. At those hearings, the Department of Homeland Security (DHS) argued that government policies and actions did encourage resilience as well as protection. Even so, subsequent policy documents made greater reference to resilience. At first those references were relatively superficial, but later they became more substantive. Policy has evolved to the point that resilience and protection of critical infrastructure assets are recognized as distinct options to be equally considered when seeking to reduce the risks associated with potential attacks on critical infrastructures. As policy has evolved, programs have also evolved somewhat, to support efforts at improving critical infrastructure resiliency. The Office of Infrastructure Protection within …