{'fraction_non_alphanumeric': 0.03240594372431236, 'fraction_numerical': 0.001422699968384445, 'mean_word_length': 5.570093457943925, 'pattern_counts': {'":': 0, '<': 0, '<?xml version=': 0, '>': 0, 'https://': 0, 'lorem ipsum': 0, 'www.': 0, 'xml': 0}, 'pii_count': 0, 'substrings_counts': 0, 'word_list_counts': {'cursed_substrings.json': 0, 'profanity_word_list.json': 0, 'sexual_word_list.json': 0, 'zh_pornsignals.json': 0}}
Critical Infrastructure as Complex Emergent Systems

The United States Department of Homeland Security (DHS) is charged with “build[ing] a safer, more secure, and more resilient America by enhancing protection of the Nation’s Critical infrastructure and key resources (CI/KR) ...” using an all-hazards approach. The effective implementation of this strategy hinges upon our understanding of catastrophes and their potential effect on the functioning of our infrastructure. Unfortunately, there has been no unifying theory of catastrophe to guide decisionmaking, preparedness, or response. We do not know, for example, why some catastrophes are “worse” than others, or if the rate of catastrophes is increasing or decreasing. Furthermore, DHS has adopted a risk-informed decision-making process, but has done so without defining key terms, such as “risk”, or quantifying the primary elements of risk – definitions that are badly needed before setting a course of action and allocating resources. We present a framework, based upon network science and normal accident theory that can be used to guide policy decisions for homeland security. We show that exceedance probability, which is commonly used by the insurance industry to set hazard insurance premiums, provides a unifying policy framework for homeland security investments. Furthermore, since the exceedance probability for catastrophic consequences obeys a power law, we define resilience, explicitly, as the exponent of that power law. This allows a mathematical definition of resilience that resonates with our innate sense of resilience. That is, the more resilient a given system, the larger it’s resiliency exponent. Such an approach also allows one to classify hazards as ‘high’ or ‘low’ risk, according to the resiliency exponent, and to guide investments towards prevention or response. This framework provides a more rigorous foundation for Federal investment decisions and a rational basis for policies to best protect the Nation’s infrastructure. A strategy without a theory The United States Department of Homeland Security (DHS) is charged with the responsibility of “build[ing] a safer, more secure, and more resilient America by enhancing protection of the Nation’s Critical infrastructure and key resources (CI/KR) to prevent, deter, neutralize, or mitigate the effects of deliberate efforts by terrorists to destroy, incapacitate, or exploit them; and to strengthen national preparedness, timely response, and rapid recovery in the event of an attack, natural disaster, or other emergency.” The homeland security strategy is considered all-hazards because it embraces both natural and human-made catastrophes such as Hurricane Katrina, and the 9/11 Terrorist attacks. The effective implementation of the all-hazards strategy hinges upon our understanding of catastrophes: earthquakes and wild fires in Southern California; hurricanes in Florida; terrorist attacks on infrastructure; and pandemic threats such as the H1N1 influenza. Unfortunately, there has been no unifying theory of catastrophe to guide decisionmaking, preparedness, or response. We do not know, for example, why some catastrophes are “worse” than others, or if the rate of catastrophes is increasing or decreasing. Moreover, we do not know what properties of a human or natural system contribute to fragility or resilience. This lack of understanding has led to organizational confusion (what is the goal?), duplication of effort (different agencies doing the same thing), and poor utilization of limited resources (inadequate identification of the most at-risk assets, maximal return on investment, and resourcing of adequate response capability). DHS has adopted a riskinformed decision-making process, but has done so without defining key terms such as “risk” or quantifying the primary elements of risk: “threat”, “vulnerability”, “resilience”, and “consequence” – terms used throughout DHS policy and strategy documents. Riskinformed decisions are difficult to make without operational definitions of risk and resiliency! For example, the National Strategy for the Physical Protection of Critical Infrastructure and Key Assets recommends, “the first objective of this strategy is to identify and assure the protection of those assets, systems, and functions that we deem most ‘critical’ in terms of national-level public health and safety, governance, economic and national security, and public confidence. We must develop a comprehensive, prioritized assessment of facilities, systems, and functions of national-level criticality and monitor their preparedness across infrastructure sectors.” This is a laudable objective, but since 2003 DHS has not been able to define ‘critical’, ‘prioritization’, or ‘preparedness’ – definitions that are badly needed before setting a course of action and allocating precious resources. The authors claim this malady will continue to persist until a suitable theory of catastrophe is developed and turned into practice. We propose a theory of all-hazards catastrophe, the results of which can be used to guide policy decisions for homeland security. Our theory is based on network science and normal accident theory. In a related approach, Ramo borrows on ideas taken from physical science to explain how political disasters happen. Ramo’s ideas were previously explored and illustrated by Buchanan in a broader context. Similarly, Taleb’s highly popular book on randomness lays the foundation for some of the ideas expressed in the author’s theory of catastrophe – specifically addressing the claim that many catastrophes are the result of random processes, rather than deterministic cause-andeffects. While Taleb focuses on “black swans” – highly unlikely, highly consequential, unpredictable events, we argue that black swans are statistically predictable and follow a power law exceedence probability distribution. Lewis applied the theory of complex systems to critical infrastructure and showed the relationship between power laws, black swans, and normal accident theory to critical infrastructure systems. Thus, power laws appear to be fundamental to catastrophe theory, which raises the question of “why”? Our answer: catastrophic events, including black swans, are normal accidents that increase with increasing self-organization.