Protection of Critical National Infrastructure

1. Protection of Critical National Infrastructure APT-ITU workshop on the International Telecommunications Regulations Bangkok, 6-8 February 2012 PreetamMaloor, ITU

2. Background : References in ITU’s Basic text PP-10 Res. 130 (Strengthening the role of ITU in building confidence and security in the use of information and communication technologies) PP-10 Res. 174 (ITU's role with regard to international public policy issues relating to the risk of illicit use of information and communication technologies) • ITU CS/CV contains references to the acknowledgement of the right of a Member State over its telecommunications and related infrastructure, considered critical national infrastructure ITU CS/Art.38 emphasizes the importance of the protection of a nation’s telecommunication infrastructure in order to ensure the stability and reliability of international telecommunications ITU CS/Art.34 which provides that Member States may cut off, in accordance with their national law, any private telecommunications which may appear dangerous to the security of the State or contrary to its laws, to public order or to decency ITU CS/Art.35 on the right of a Member Stateto suspend its international telecommunication service. Critical national infrastructure has not been explicitly defined in ITU’s Basic Text or decisions made by ITU bodies. However, many references to the protection of critical national infrastructure exist especially in the context of security of telecommunications/ICT networks and services.

3. Background : References in current ITRs • ITRs/Art.7(Suspension of Services) which refers to the right of a Member State to suspend its international telecommunication services partially or totally, while also ensuring the need for appropriate timely notification of this action • ITRs/Art. 9 (Special Arrangements)which provides thatany such special arrangements should avoid technical harm to the operation of the telecommunication facilities of third countries • Protection of telecommunication/ICTs as a critical national infrastructure not explicitly mentioned in the current ITRs • Implicit references include: • the acknowledgement of the right of a Member State over its telecommunications and related infrastructure • the need for a Member State to take into consideration the global implications of its actions concerning its national telecommunications infrastructure

4. Overview of global precedents and challenges - Definitions Critical Resources Critical (national) Infrastructure Critical Information Infrastructure

5. Definition: Critical Resources • Most expansive of all the terms. Includes those assets within the sphere of critical infrastructure and critical information infrastructure • Has been defined by some national governments to include • natural and environmental resources such agriculture, energy, freshwater, rainforests, etc. • national monuments and icons which have been defined as a physical structure or object recognized both nationally and internationally as representing a nation’s heritage, traditions and/or values.

6. Definition: Critical Infrastructure • Primarily defined in the context of • the adequacy of a nation’s public works, e.g. bridges, roads, airports, dams, etc. • includes telecommunications, in particular major national and international switches and connections. • Many countries, in defining critical infrastructure, include in the definition a reference to that nation • Many other countries have specifically included the national component in the term itself (e.g. UK)

7. Definition of Critical Infrastructure : Examples from Member States, Regional groups

8. Definition: Critical Information Infrastructure In Germany, the majority of information infrastructures are run by private companies. Hence, protecting these infrastructures is primarily the task of private operators and service providers. However, given the dramatic consequences damage to those infrastructures might have for the state, the economy and large parts of the population, sole responsibilities of individual operators is neither sufficient nor appropriate. This holds true also for critical infrastructures in Germany*. *Germany’s Federal Ministry of the Interior in a 17 June 2009 report entitled National Strategy for Critical Infrastructure Protection • Increasing reliance on IP-based and other networks as an ubiquitous aspect of social and economic activities of nations • a fundamental component in the design and operation of all forms of “traditional” critical infrastructure (e.g. electricity grids, transportation systems, water supply etc.) • Therefore, some have proposed the introduction of a new term, Critical Information Infrastructure.

9. Definition: Critical Internet Resources • With emergence of a global information society, the term “Critical Internet Resources” is considered by many (e.g. CoE) as related to critical information infrastructure in the Internet era. • Subject of intense discussions at WSIS and other international fora • No consensus yet on the proper scope of these resources • general agreement on IP addresses, domain names, and root servers • More expansive view (e.g. CoE): includes backbone infrastructure and IXPs; broadband access • Some argue that considering the dynamic nature of the internet, there should be no rigid definitions and specifically enumerated lists? • e.g. deployment of DNSSEC key signing keys in 2010

10. Critical Information Infrastructure as intangible assets • E.g. telecommunication infrastructure and number portability • In many jurisdictions, it is not clear who “owns” the telephone number, that is, who has what rights over the number (e.g. can somebody sell or rent the number?). • Similar issue is being faced by many countries on some Internet resources: • whether Internet names and addresses constitute an intangible property, or if it is a mere service which registrants enter into a contractual relationship with the provider

11. Evolution of Definitions to recognize Intangible Property (old) Canada’s critical infrastructure consists of those physical and information technology facilities, networks, services and assets which, if disrupted or destroyed, would have a serious impact on the health, safety, security or economic well-being of Canadians or the effective functioning of governments in Canada. CANADA (current) Critical infrastructure refers to processes, systems, facilities, technologies, networks, assets and services essential to the health, safety, security or economic well-being of Canadians and the effective functioning of government. Critical infrastructure can be stand-alone or interconnected and interdependent within and across provinces, territories and national borders. Disruptions of critical infrastructure could result in catastrophic loss of life, adverse economic effects and significant harm to public confidence. (old) Critical infrastructure include those physical resources, services, and information technology facilities, networks and infrastructure assets which, if disrupted or destroyed, would have a serious impact on the health, safety, security or economic well-being of citizens or the effective functioning of governments. EU (current) ‘critical infrastructure’ means an asset, system or part thereof located in Member States which is essential for the maintenance of vital societal functions, health, safety, security, economic or social well-being of people, and the disruption or destruction of which would have a significant impact in a Member State as a result of the failure to maintain those functions

12. Bilateral Commercial Arrangements between parties as a critical resource ? * Internet governance and critical internet resources, Council of Europe Secretariat, April 2009 • CoE Secretariat report* includes information on the growing reliance of bilateral commercial arrangements between parties as a critical resource and their potential to significantly disrupt global connectivity and resolution. Some reasons cited: • Growing dominance of Internet Exchange Points • major ISPs unwillingness to enter into direct traffic exchange relationships • The failure of these critical bi-lateral contract resources could significantly disrupt the operation of the Internet • E.g. a 2008 dispute between Cogent Communications, a US based internet service provider, and TeliaSonera, Sweden’s largest telecom company cut off access to certain websites to a significant customer base in both continents.

13. Multilateral Cooperation in the Protection of Critical National Infrastructure Canada-United States Action Plan for Critical Infrastructure :The complexity and interconnectedness of Canada-U.S. critical infrastructure requires that the Canada-U.S. Action Plan be implemented using organizational structures and partnerships committed to sharing and protecting information and managing risks Australia: Critical Information Resources is a shared responsibility across governments and the owners and operators of critical infrastructure NATO:Critical Infra. Protection (CIP) involves several stakeholders: public authorities - at the national and local levels, including various public agencies; critical infrastructure operators, which are often private sector firms; and the population at large. CIP has also increasingly gained an international dimension, which raises the question of international co-operation on CIP Nations consider protection of their critical infrastructure as closely linked to the protection of their national sovereignty and have a variety of national legislations in place to safeguard this infrastructure. General agreement that the protection of critical national infrastructure requires multilateral cooperation

14. Proposals made to CWG-WCIT There is no consensus yet on the proposals • ITRs do not explicitly refer to protection of critical resources or infrastructure. They do, as mentioned above, implicitly cover the concept. • Some provisions of the current ITRs can be considered to specifically relate to the concept, • E.g. the provision in article 9 that special arrangements should avoid technical harm to the operation of the telecommunication facilities of third countries. • Various proposals have been made to modify or increase the scope of such provisions, for example to include avoidance of “financial harm”. • Various proposals regarding the misuse of numbering resources could be considered as related to protection of critical information resources, if it is held that naming, numbering, addressing, and identification resources are such critical information resources. •  Some might consider that proposals to CWG-WCIT related to quality of service and international routes are related to protection of critical resources.