Australian Government Invites Feedback on Critical Technologies

The Australian Federal Government will begin consulting businesses, researchers and the community at large to identify critical technologies of national importance.

The List of Critical Technologies in the National Interest will clarify technologies the government considers to be vital to present and future demands.

The 2022 List of Critical Technologies in the National Interest will build on the 2021 List, which featured 63 technologies across seven categories including:

- Advanced materials and manufacturing
- AI, computing and communications
- Biotechnology, gene technology and vaccines
- Energy and environment
- Quantum; Sensing, timing and navigation
- Transportation, robotics and space

The consultation will run until Friday 30 September.

Federal Minister for Industry and Science, Ed Husic, said it is vital for Australia’s continued and future prosperity that emerging and critical technologies are promoted and protected.

“We know the development of critical technologies present enormous potential opportunities as well as risks for Australians,” Mr Husic said.

“It is vital we understand and send a clear signal about what technologies we should be focusing on and where our strengths lie – and that is exactly what this consultation is all about.”

The Federal Government has promised to invest $1 billion into critical technologies through its National Reconstruction Fund and will aim to reach 1.2 million tech industry jobs by 2030.

“This work is also part of our goal to reach 1.2 million tech jobs by 2030, as well as securing our supply chains and promoting Australia as a secure destination of excellence for investment, development and adoption of critical technologies,” Mr Husic said.

“The Government is also investing $1 billion in critical technologies as part of the National Reconstruction Fund, to build our strategic capability and power the economic growth we need to create jobs.”

UNODC improves Port Security in Rodrigues Island, Mauritius in the Indian Ocean

Rodrigues is an autonomous outer island of the Republic of Mauritius, located in the Indian Ocean between the African and Asian continents with an estimated population of 43,538 people.

In line with the United Nation’s Office on Drugs and Security (UNODC) Strategic Vision for Africa 2030, under investment area 3 ‘Protecting Africa’s Resources and Livelihoods’ UNODC conducted a 10 - day extensive training on Port Security with officials from Mauritius Port Security.

The training equipped participants with relevant skills and modern techniques to combat Maritime Crimes and improve port security. Overall, this will also contribute to attainment of the United Nation’s Sustainable Development Goal 14 on Life Below Water, targeting Sustainable Management and Protection of Marine and Coastal Ecosystems.

“It’s not a secret to anybody that transnational organized maritime crime poses a significant threat to the national security with implication on public safety and economic activities. Now all those crimes are increasingly committed using more sophisticated means whereby offenders are constantly exploring all means to improve their crime. We are in the urgency to get ourselves prepared to face the challenges. This training comes at the right moment” says Raphael Jean Maxcy, Police Sergeant and Assistant Officer in Charge of National Coast Guard, Rodrigues.

Leung Kei, Administrative officer at Port Associated Portage Operations, Lighterage and Cargo Services (PAPOL & C.S) quips, “The training will help me a lot in my daily work mainly in port security. It has opened our eyes so that in the future we know how to deal with all security matters at the port. Although we do not have big cases of insecurity, at the depot where clients come to pick their delivery, we must be very vigilant now as drug trafficking is becoming popular in Rodrigues, little by little”.

Political agreement on new rules to enhance the resilience of critical entities

As a key part of the EU's work to build a Security Union, the new rules will strengthen the resilience of critical infrastructure to a range of threats, including natural hazards, terrorist attacks, insider threats, or sabotage, as well as public health emergencies like the recent COVID-19 pandemic.

Against an ever more complex risk landscape, the new Directive replaces the European Critical Infrastructure Directive of 2008. A wider sectoral scope will allow Member States and critical entities to better address interdependencies and potential cascading effects of an incident. Eleven sectors will be covered: energy, transport, banking, financial market infrastructures, health, drinking water, wastewater, digital infrastructure, public administration, space, and food.

Vice-President for Promoting our European Way of Life, Margaritis Schinas, said: “It is essential to shield our economy and our society against physical threats that could disrupt services that are vital for people's daily lives and for the functioning of our internal market. With today's agreement, we are delivering on our commitment to enhance the resilience of critical infrastructure in the EU, complementing the recently strengthened cybersecurity legislation. Together, these new rules form a coherent and robust system to protect our infrastructure online and off”.

Commissioner for Home Affairs, Ylva Johansson, said: “In the light of the current geopolitical situation in Europe, enhancing our resilience is of key importance. The CER Directive will make us better prepared against disruptions that impact the security of our citizens and the prosperity of the internal market, following the lessons learnt from the pandemic and long-term challenges like climate change. The new Directive will ensure the provision of essential services such as energy, transport, water and healthcare while minimising the impact of natural and man-made incidents”.

The proposal introduces new rules to strengthen the resilience of critical entities:

- Member States will need to adopt a national strategy and carry out regular risk assessments to identify entities that are considered critical or vital for the society and the economy.
- Critical entities will need to carry out risk assessments of their own, take technical and organisational measures to enhance their resilience and notify incidents. They will also be able to request background checks on personnel holding sensitive roles.
- Critical entities in the EU, from the sectors covered, providing essential services in six Member States or more, will benefit from extra advice on how best to meet their obligations to assess risks and take resilience-enhancing measures.
- A Critical Entities Resilience Group will facilitate cooperation among Member States and the exchange of information and good practices.
- An enforcement mechanism will help ensure that the rules are followed: Member States will need to ensure that national authorities have the powers and means to conduct on-site inspections of critical entities. Member States will also introduce penalties in case of non-compliance.
- Member States will need to provide support to critical entities in enhancing their resilience with, for instance, guidance material. The Commission will provide complementary support to Member States and critical entities, by developing a Union-level overview of cross-border and cross-sectoral risks, best practices, methodologies, cross-border training activities and exercises to test the resilience of critical entities, among others.

Next steps

The political agreement reached by the European Parliament and the Council is now subject to formal approval by the co-legislators. Once published in the Official Journal, the Directive will enter into force 20 days after publication. Member States will then need to transpose the elements of the Directive into national law within 21 months.

Coastal Navigation: Authorized Purposes of Marine Structures Can Impact Corps' Maintenance and Repair

The movement of commerce involves the ability of the Corps to provide safe, reliable, efficient, and environmentally sustainable waterborne transportation systems. The agency is tasked with maintaining and repairing coastal navigation structures that are part of harbors and ports. The Corps' activities, including the type and scope of coastal navigation structures that the Corps may construct and maintain, are authorized by Congress. The authorization usually refers to the document or report recommending the project to Congress, which Congress then references in the legislation authorizing the project.

A number of the coastal navigation structures maintained by the Corps were built over a century ago and may no longer be sufficient to meet current conditions and changes in the climate. For example, increased wave and storm intensity in coastal areas threaten the integrity of jetties that shelter harbor basins and entrances from waves. This potentially jeopardizes lives and communities, disrupts commercial navigation traffic, and increases the frequency and cost of needed repairs.

A report accompanying the 2020 Energy and Water Development and Related Agencies Appropriations Bill includes a provision for GAO to review how to increase the Corps' capacity to repair and maintain existing projects before they deteriorate to the point of failure. This report describes what factors, if any, affect the Corps' ability to consider impacts not directly related to navigation when determining which existing coastal navigation structures to maintain and repair.

To address this objective, GAO selected coastal navigation structures at four projects for use as illustrative examples based on input from Corps officials. GAO reviewed legislation and Corps documents to verify statements about the Corps' oversight of the structures, as appropriate. GAO interviewed officials from Corps headquarters, all eight divisions based in the United States, and at least one district from each division (16 districts total). GAO also interviewed nonfederal partners, such as officials from state and local government and organizations representing the navigation industry.

The authorized purpose of coastal navigation structures can impact the U.S. Army Corps of Engineers' (Corps) maintenance and repair decisions. According to Corps officials in headquarters, divisions, and selected districts, the authorizing language for coastal navigation structures in some instances (1) designates navigation as the structures' authorized purpose and (2) can restrict flexibility or adaptive management.

Specifically, the authorizing language directs the Corps to consider navigation benefits and impacts for coastal navigation structures when making repair decisions. Corps officials said that because there is not enough funding to cover all the maintenance and repair needs for these structures in a given year, the agency prioritizes the structures based on navigation-focused criteria—primarily the amount of commercial tonnage. Yet some structures provide economic value even though they may not have the highest commercial tonnage, according to Corps officials. These officials said that they cannot incorporate nonnavigation benefits of structures, such as protection of coastal areas, when making decisions, absent a change to the authorizing language or an additional authorization.

The authorizing language can also restrict the Corps' ability to adapt structures to current conditions. The language can include or reference structure specifications—specific length or height—that do not allow the Corps to make updates to the structures that could better address current or changing conditions, according to Corps officials. The officials told GAO that although the authorizing language for structures varies in terms of the levels of specificity, the language for some structures requires the Corps to use original design specifications that can date back decades when repairing damaged structures when the authorizing language is restrictive. The Corps views repairs that do not adhere to the original specifications as unauthorized. However, these specifications may not reflect current design standards or changes in the conditions affecting the structures since the structures were built. For example, the structures' designs may not be able to address more frequent severe storms and wave action and sea level rise. Flexibility in making decisions on how to maintain and repair coastal navigation structures could better position the Corps to address these changing conditions, according to Corps officials.

Investing in resilient infrastructure for a better future

Day-to-day life depends on infrastructure and its services, this includes supply-chains, electricity, water and sanitation, and information networks. But in the face of the COVID-19 pandemic and increasing extreme weather events, these systems are under increasing threat.

A single event in December 2020, Cyclone Yasa, caused around USD 1.4 billion in damage to health facilities, homes, schools and other critical infrastructure in the Pacific island nation of Fiji. Beyond the economic toll, there was immeasurable disruption to people’s lives as a result of downed systems, extending the duration of the disaster beyond the passing of the cyclone.
Vital services for people and communities

Measuring the resilience of infrastructure is a challenge: There is no common understanding of what “resilient infrastructure” means, nor agreed benchmarks against which to gauge infrastructure resilience. Infrastructure is commonly understood as comprising assets and buildings; this needs to shift to include the vital services they provide.

“Social resilience touches on the capacity for a community to adapt, a resilient community is able to respond to changes, post-stress, in a positive way,” said Esther Anyakun Davinia, Uganda’s Minister of State for Relief, Disaster Preparedness and Refugees, speaking at a 7th Global Platform for Disaster Risk Reduction session titled, ‘Building a better future: Investing in resilient infrastructure for all’.

Moving towards net resilience gain

The Principles for Resilient Infrastructure – developed by the United Nations Office for Disaster Risk Reduction (UNDRR) to support the implementation of the Sendai Framework and the Sustainable Development Goals (SDGs) – describe a set of principles, key actions, and guidelines to create national-scale net resilience gain, and improve the continuity of critical services.

“We need a framework – such as we have for net zero," said panellist Rob Wesseling, CEO of The Co-operators Group, a Canadian insurance company. “There were no net-zero alliances not too long ago. There is already an excess of $130 trillion committed to various aspects of net zero which can be used to improve resiliency.”

Investing in sound infrastructure, Wesseling argued, would pay out in resilience dividends.

The net resilience gain approach requires that infrastructure investments enhance resilience and not create any additional risks.

The six interconnected Principles are designed to guide infrastructure stakeholders and leaders in building infrastructure resilience, calling for a process that is continuously learning, proactively protected, environmentally integrated, socially engaged, adaptively transforming, and based on shared responsibility.

The implementation process itself will give users a better understanding of their existing infrastructure systems: their performance, exposure, regulatory environment, challenges and barriers, as well as offering entry points for better risk-informed decision making and investments.

“Short cuts lead to greater costs, so maintenance needs to be integrated,” said Dena Assaf, United Nations Resident Coordinator for the United Arab Emirates. “How the infrastructure systems are maintained and integrated must be informed by the Principles for Resilient Infrastructure.”
A stress test to measure policy impacts on infrastructure resilience
“Infrastructure stress testing helps governments and stakeholders to base policy decisions and investments on factual and up-to-date information on the status of the resilience of infrastructure systems."
- Beata Janowczyk

Regulations that govern critical infrastructure also need strengthening. Governments must revisit their mechanisms and practices to evaluate whether they can cope with increasing requirements brought about by climate change, shifting demographic and development patterns, and other stresses.

Understanding the risk landscape – and its potential impacts on public finances – provides a good basis for realistic assessments of the costs and benefits of financing and policy options.

UNDRR’s recently developed Resilient Infrastructure Stress Test helps policymakers to see how policy changes could impact critical infrastructure, exposing major gaps to be prioritized. The stress test measures infrastructure performance against various stressors, and offers an assessment to provide specific policy recommendations.

“Infrastructure stress testing helps governments and stakeholders to base policy decisions and investments on factual and up-to-date information on the status of the resilience of infrastructure systems,” said Beata Janowczyk, head of the Risk Assessment and Emergency Planning Unit in Poland’s Centre for Security.

With significant recovery funding investments being made in new infrastructure, risk reduction and resilience must be central considerations shaping how and where these resources are spent.

List V: Informing the global maritime community

The International Telecommunication Union (ITU) has released the latest edition of its key global maritime publication – List of Ship Stations and Maritime Mobile Service Identity Assignments. Well known among ship operators, the annual publication has helped keep seafarers safe and informed for nearly a century.

Commonly referred to as List V, this publication contains crucial contact information and other administrative and operational data on over 900,000 ship-borne radio stations around the world.

The publication and accompanying software enable users to retrieve operational data about any given ship – such as its name, call sign, Maritime Mobile Service Identity (MMSI), and phone number, along with the vessel type, tonnage, number of passengers or crew, and onboard radiocommunication equipment.

This key maritime compendium lists port authorities and rescue coordination centers with their shore-side contact information. List V also includes identification codes for search and rescue aircraft and contact details for accounting authorities.

Rescue mission critical

If disaster strikes, List V is a vital tool that can help maritime authorities quickly recognize ships in distress and coordinate rescue operations.

Increasingly, the ITU publication also exposes vessels giving false distress alerts – a growing problem for the maritime community.

List V information that is fed into the Global Maritime Distress and Safety System (GMDSS), which then sends alerts to search and rescue authorities, helps keep the maritime environment safer for ships, crews, and passengers everywhere.

List V history

The history of List V begins at the International Radiotelegraph Conference held in Washington, DC, in 1927. That conference introduced the first provisions related to maritime publications into the Radio Regulations – the treaty maintained by ITU to govern radio frequency assignments worldwide. Shortly after, ITU began publishing its List of Ship Stations and List of Callsigns.

ITU’s lists were substantially updated after the 2007 World Radiocommunication Conference to reflect evolving maritime technologies and enhanced safety protocols. The ship station and callsign lists were then consolidated into a single publication, the first edition of which was issued in March 2011.

Building cyber secure Railway Infrastructure

The European Union Agency for Cybersecurity (ENISA) delivers a joint report with the European Rail Information Sharing and Analysis Center (ISAC) to support the sectorial implementation of the NIS Directive.

The report released is designed to give guidance on building cybersecurity zones and conduits for a railway system.

The approach taken is based on the recently published CENELEC Technical Specification 50701 and is complemented with a guidance to help railway operators with the practical implementation of the zoning process.

The work gathers the experience of the European Rail ISAC and of their members such as European infrastructure managers and railway undertakings, which are Operators of Essential Services (OES) as defined in the Security of Network and Information Systems (NIS) directive and is designed to help them implement the cybersecurity measures needed in the zoning and conduits processes.

A number of requirements are set, such as:

- Identification of all assets and of basic process demands;
- Identification of global corporate risks;
- Performing zoning;
- Checking threats.

A risk assessment process is developed based on standards for the identification of assets and the system considered, and for the partitioning of zones and conduits. The report also addresses the cybersecurity requirements in terms of documentation and suggests a step-by-step approach to follow.

The report is released on the occasion of the General Assembly meeting of the European Rail ISAC which is taking place today.

The EU Agency for Cybersecurity engages closely with the European Rail Agency (ERA) to support the railway sector and is to host a joint event with ERA later this year.

Landmark IPCC report must be wake-up call for greater investment in disaster risk reduction

Following the release of the IPCC Working Group II Report on Impacts, Adaptation and Vulnerability, Mami Mizutori, Special Representative of the UN Secretary-General for Disaster Risk Reduction, issued the following statement:

The findings of the latest IPCC report are dire. Communities around the world are being affected by climate change at a magnitude worse than expected. The devastating impacts of climate disasters are affecting every part of the world.

As the UN Secretary-General António Guterres said today “The IPCC report is an atlas of human suffering and a damning indictment of failed climate leadership.”

Many of the changes are at risk of becoming irreversible. On our current trajectory, the world is set to breach the 1.5 °C safe global temperature limit by the early 2030s, spiralling to dangerous levels of disaster risk. Almost half the human population is already in the danger zone

It is incomprehensible that we knowingly continue to sow the seeds of our own destruction, despite the science and evidence that we are turning our only home into an uninhabitable hell for millions of people.

Based on current trends, a record increase in medium and large-scale disasters is expected with droughts doubling, and extreme temperature events almost tripling to 2030. Overall, disaster events have doubled in the last 20 years compared to the previous 20 years. If countries and governments do not manage it properly and respond to the climate emergency with urgency, there’s a very real chance that we’ll see them double again.

Yet the world also has an opportunity to meet these challenges. At the Global Platform for Disaster Risk Reduction in Bali, Indonesia this May, organised by the UN and hosted by Indonesia, leaders will gather to discuss how to accelerate action for reducing these risks.

The IPCC report points to many solutions on improving regional and local information, providing sound data and knowledge for decision makers. This does work. Countries have succeeded in saving many lives through improved early warning systems and preparedness.

But climate disasters will undoubtedly worsen. There are very low levels of investments in disaster prevention and disaster risk reduction for the world’s most vulnerable countries on the front lines of impacts. We need to ramp up investment in disaster prevention if we are to cope with the exponential rise of disaster events in recent decades.

A crucial recommendation in the report today is the need for climate-resilient development – inclusive governance that embeds finance and actions across governance levels, sectors and timeframes.

Furthermore, all countries are impacted by climate change, but not in the same way. The most vulnerable communities and nations are the hardest hit, and need greater support on climate finance to adaptation and to avert, minimize and address losses and damages. This means increasing financing for climate change adaptation from tens to hundreds of million dollars.

We need to ensure that regulations and funding take into account disaster risk and that climate risk in financial markets is disclosed. Governments need to make disaster resilience a priority through dedicated funding to prevention.

Information Technologies for Managing Federal Use

Radio-frequency spectrum is a scarce natural resource vital to many commercial and government activities, including weather observation, air traffic control, and national defense. NTIA and government agencies have a responsibility to manage their spectrum use wisely. To do so, agencies rely on different spectrum-related IT, but NTIA has recently highlighted that existing IT is out-of-date and hinders spectrum management.

Federal officials said modernization of spectrum-related federal IT could provide benefits such as greater sharing of the limited spectrum and improved efficiency. For example, the current process for assigning spectrum relies on manual reviews of frequency requests and manual input of data. Automation could reduce errors and speed the process.

The FY21 NDAA contains a provision for GAO to review the current spectrum-related IT of covered agencies. This report describes (1) the existing spectrum-related IT that covered agencies employ to manage their spectrum use, and (2) the opportunities covered agencies and NTIA identified for improving spectrum management through IT modernization. The FY21 NDAA also contains a provision for GAO to conduct oversight of the implementation of agencies' spectrum-related IT modernization plans. This topic will be the subject of future GAO work.

Federal agencies use a variety of information technologies (IT) to manage their use of radio-frequency spectrum. The William M. (Mac) Thornberry National Defense Authorization Act for Fiscal Year 2021 (FY21 NDAA) required the National Telecommunications and Information Administration (NTIA) and covered agencies to develop plans to modernize their spectrum-related IT (i.e., the software, databases, and other tools that comprise their spectrum infrastructure).

Currently, the NTIA provides agencies with some spectrum-related IT systems, such as software, databases, and engineering tools, so that they can participate in NTIA's spectrum management processes. These processes include assigning frequencies for agencies to use and certifying spectrum-dependent equipment. GAO found that all 20 agencies covered by the FY21 NDAA modernization requirement rely at least in part on NTIA-provided IT to manage their spectrum use. Additionally, most of these agencies—DOD and the Federal Aviation Administration, in particular—augment NTIA-provided IT with additional spectrum-related IT that meets their unique mission needs.

Many of the officials GAO interviewed broadly agreed that modernizing spectrum-related IT could provide opportunities to improve spectrum management, mostly related to the following: (1) improving current spectrum management processes by addressing some limitations in existing spectrum-related IT and (2) facilitating the potential for greater spectrum sharing (i.e., enabling more than one spectrum user to use the same frequency band without interfering with each another). As NTIA and the covered agencies advance their modernization efforts in 2022, it is not yet clear if their plans will target these opportunities.

 

Critical Infrastructure Protection: Agencies Need to Assess Adoption of Cybersecurity Guidance

Federal agencies with a lead role to assist and protect one or more of the nation's 16 critical infrastructures are referred to as sector risk management agencies (SRMAs). The SRMAs for three of the 16 have determined the extent of their sector's adoption of the National Institute of Standards and Technology's (NIST) Framework for Improving Critical Infrastructure Cybersecurity (framework). In doing so, lead agencies took actions such as developing sector surveys and conducting technical assessments mapped to framework elements. SRMAs for four sectors have taken initial steps to determine adoption (see figure). However, lead agencies for nine sectors have not taken steps to determine framework adoption.

Status of Framework Adoption by Critical Infrastructure Sector

Regarding improvements resulting from sector-wide use, five of the 16 critical infrastructure sectors' SRMAs have identified or taken steps to identify sector-wide improvements from framework use, as GAO previously recommended. For example, the Environmental Protection Agency identified an approximately 32 percent overall increase in the use of framework-recommended cybersecurity controls among the 146 water utilities that requested and received voluntary technical assessments. In addition, SRMAs for the government facilities sector identified improvements in cybersecurity performance metrics and information standardization resulting from federal agencies' use of the framework. However, SRMAs for the remaining 11 sectors did not identify improvements and were not able to describe potential successes from their sectors' use of the framework.

SRMAs reported various challenges to determining framework adoption and identifying sector-wide improvements. For example, they noted limitations in knowledge and skills to implement the framework, the voluntary nature of the framework, other priorities that may take precedence over framework adoption, and the difficulty of developing precise measurements of improvement were challenges to measuring adoption and improvements. To help address challenges, NIST launched an information security measurement program in September 2020 and the Department of Homeland Security has an information network that enables sectors to share best practices. Implementing GAO's prior recommendations on framework adoption and improvements are key factors that can lead to sectors pursuing further protection against cybersecurity threats.

The U.S. has 16 critical infrastructure sectors that provide clean water, gas, banking, and other essential services. To help protect them, in 2014 the National Institute of Standards and Technology developed cybersecurity standards and procedures that organizations within these sectors may voluntarily use. Federal agencies are charged with leading efforts to improve sector security.

The GAO have found agencies have measured the adoption of these standards and procedures for 3 of 16 sectors and have identified improvements across 2 sectors. For example, the EPA found a 32% increase in the use of recommended cybersecurity controls at 146 water utilities.

1 2 3 4 5 6 9