29 May 2006 RNSA Workshop 1

Social Implication of National Security RNSA Workshop

The risk of public data availability on critical

infrastructure protection

Roba AbbasBICT (Hons) Candidate

29 May 2006 RNSA Workshop 2

Public Data Availability Literature

-Role of ICTs-National security, open

information access & privacy

Literature clusters

Critical Infrastructure Literature

-Physical vs. cyber infrastructures-Infrastructure

interdependencies

Critical Infrastructure Protection Literature

-Recent events-CIP processGAP

29 May 2006 RNSA Workshop 3

What is critical infrastructure?

In Australian context: banking & finance transport &

distribution energy & utilities health the food supply communications

1. Cyber infrastructures2. Infrastructure

interdependencies must also be noted, that is, the relationship between the infrastructure

Vital services contributing to the security & stability of a country

29 May 2006 RNSA Workshop 4

What is critical infrastructure protection (CIP)?

Safeguarding the identified services from potential harm, including physical and/or electronic attacks

The process of protecting critical infrastructure has become increasingly important due to a number of recent events

e.g. Y2K, 9/11, Bali

Although the specific details of the activities vary, the stages of the CIP process are standardised:

Vulnerability Assessment

Risk Assessment

RiskManagement

29 May 2006 RNSA Workshop 5

What is public data availability?

Refers to ‘sensitive but unclassified’ data public records that may be accessed

Includes both free and commercial information Since 9/11:

a direct link has been drawn between public data collection (facilitated by ICTs) and the act of terrorism

29 May 2006 RNSA Workshop 6

Public data elements and their use

Articles/ Documents Maps/ Photographs Statistical Information Transactions/ Records Personal information Community facilities Multimedia Phone/ Email/ IP Address

Social service needs Competitive intelligence Geospatial intelligence Data mining Sabotage Cyberfraud Terrorism

29 May 2006 RNSA Workshop 7

Previous studies

Breeding (2003) Sensitive but Unclassified

Information: A Threat to Physical Security

Weinmann (2006) Terror on the Internet: The New

Arena, The New Challenges Both describe the need for

controlling access to public data, in order to maintain national security

How do we balance open information access

and national security concerns?

29 May 2006 RNSA Workshop 8

Document Analysis

Content AnalysisTools: Leximancer

data mining software

List of data suppliers

Information about public data

collection process

Qualitative

Observation

ScenariosTools: Meridian

GPS, MapInfo GIS software

Set of threat scenarios for

survey

Qualitative

Survey

StatisticsTools: SPSS

software

Community awareness levels

of threats of public data

availability on CIP

Quantitative

Data SearchData Search ScenariosScenarios AwarenessAwareness

Document Analysis

Content AnalysisTools: Leximancer

data mining software

List of data suppliers

Information about public data

collection process

Qualitative

Observation

ScenariosTools: Meridian

GPS, MapInfo GIS software

Set of threat scenarios for

survey

Qualitative

Survey

StatisticsTools: SPSS

software

Community awareness levels

of threats of public data

availability on CIP

Quantitative

Data SearchData Search ScenariosScenarios AwarenessAwareness

29 May 2006 RNSA Workshop 9

29 May 2006 RNSA Workshop 10

29 May 2006 RNSA Workshop 11

Significance of study

Terror was his doctrine, court told:

“The alleged preparations included acquiring two maps of the grid under a false company name and downloading 38 aerial photographs of the defence sites”

Sydney Morning Herald article, Tuesday 25th May 2005

However… ICTs can aid national

security efforts Public data may be

used for positive purposes

29 May 2006 RNSA Workshop 12

Questions?

29 May 2006 RNSA Workshop 13

Next steps

1. To identify the agencies supplying data across Australia

2. To create a geographic information system (GIS) for Wollongong Australia on critical infrastructure

3. To determine the potential misuse or threats of Objective 1 & 2 data being publicly available

4. To assess the level of community awareness related to public data availability

29 May 2006 RNSA Workshop 14

2 important aspects of CIP process have been ignored…

Community awareness Community awareness

is required in the initial stages of the CIP process

Some authors claim that lack of community awareness has contributed to the severity of the recent events

Regional context Successful CIP requires

the input of both federal and local governments

Metropolitan cities have been the focus of CIP efforts

Regional areas play an important role in the supply chain