Comparing Critical Infrastructure Policy Updates
Russian attacks on Ukrainian critical infrastructure and other crises over the last few years have led to significant critical infrastructure policy developments within the EU, NATO, and Switzerland. Recent efforts to address the challenging risk landscape emphasize resilience and cooperation to reduce the impacts of disruptive events.
Russia’s actions in Ukraine since 2014, including their full-scale invasion in 2022, have starkly illustrated the importance of critical infrastructure (CI) and the implications of its vulnerability. For instance, Russia deliberately targeted energy and communications infrastructure to gain a military advantage by disrupting vital services to the country. However, threats to CI more often fall below the threshold of armed conflict, and are frequently labeled as “hybrid threats.” These threats can arise in various forms, such as cyberattacks, espionage, disinformation, or foreign investments in infrastructure. The 2022 sabotage of the Nord Stream pipeline in the Baltic Sea has undoubtedly revealed a vulnerability in European energy infrastructure.
CI can be understood as the assets, systems, networks, and operators that enable and perform services necessary for the functioning of governments, economies, and societies upon which daily life depends. While different countries and organizations have slight variations in the definition and delimitation of CI, it is generally approached with a sectoral view. For example, by differentiating between energy infrastructure, communication services, or transportation networks, the sectoral view of CI offers one method to structure and organize the way CI is identified, managed, and protected. However, today’s CI is characterized by strong interdependencie stemming from globalization, urbanization, digitalization, and an all-incumbent cyberspace, blurring these sectoral boundaries and making it increasingly vulnerable. For example, modern-day energy grids rely on telecommunication networks and vice versa. A disruption in energy supply could have negative implications for telecommunications. More broadly, interfering in the services provided by CI can severely affect governmental capacity, economic activities, and people’s wellbeing. Potential CI disruptions stem not just from antagonistic threats but also can result from a wide range of hazards. These include natural and geophysical hazards such as floods or earthquakes and incidents caused by technical failure and human activity. For example, the train derailment involving a freight train in the Gotthard tunnel in August 2023 highlighted the impact of a disruption within the Swiss rail transportation network. Furthermore, the Western liberalization of CI, predominantly in the 1990s, has led to CI often being held or operated by private actors. This can make governmental oversight, control, and the standardization of security measures difficult when facing cost-optimized business models.
The continuing deterioration of the international security situation has significantly increased the importance of CI and its protection among Western countries and institutions. Switzerland’s Supplementary Report to the 2021 Security Policy Report, published in 2022, emphasized reviewing and adapting its strategies for resilience and cooperation in critical infrastructure protection (CIP) to be prepared for future challenges. Further, the report states that increased international cooperation, particularly with NATO and the EU, could create new opportunities to strengthen civil protection, which includes critical infrastructure protection and resilience. Consequently, reflecting on NATO and the EU’s most recent changes and the current understanding of CI resilience offers a valuable point of reference to support possible or existing cooperation. Reviewing the updated national strategy on CIP of Switzerland provides a chance to observe overlaps and divergence in CIP and CI resilience concepts among Switzerland, the EU, and NATO.