Critical Information Infrastructure and Cyber-Terrorism

2.1 Industrial Control Systems within CII

The Year 2000 (Y2K) problem highlighted a particular feature of computing systems in CII: that of industrial control systems. Until that time, most public understanding and perceptions of information technology focused on the development of the Internet and the rise of dot.com businesses; what most people considered to be a computer was the personal computer (PC). The ‘PC’ was used in businesses and in the front offices of industry to process accounting, payroll and other administrative services. Other than information technology (IT) professionals, most people have tended not to give much thought to what happens in a data centre or about enterprise applications. Information and communications technologies are however, more pervasive than that. Industrial control system computers are not located in front offices and often not even in data centres but are of a different kind, usually found in larger scientific research establishments and industrial sectors including those in critical national infrastructure (CNI). Industrial controls vary and include process controls, batch controls, and the more commonly known SCADA (Supervisory Control and Data Acquisition) system, which, as its name, oversees and deals with the calculations and processing of many flows of data and component parts or services for geographically-dispersed production and delivery. Such computer processing necessarily involves communication of data within, and as relevant outside, the facility, in order to provide the electricity, energy, telephone, water, oil, gas, transportation and other critical services that underpin a country’s survival.

As most CNI necessarily deals with or concerns a country’s population, and thus large-scale delivery of reliable services, CNI engineers and operators focused their development and testing of computer systems with issues of public safety in mind, and thus with a robustness that is not normally associated with the development of personal computers. This testing process becomes more complicated when also taking into account vulnerabilities associated with the introduction of new information technologies of the Internet and dot.com age.