Randall Jackson. Senior Legal Research Associate.
October 2005.
“All who have meditated on the art of governing mankind have been convinced that the fate of empires depends on the education of youth.” – Aristotle.
Is Aristotle suggesting that education is part of a nation’s critical infrastructure? Certainly we could look at school buildings as critical infrastructure in the sense of any large public facility. But what about the education system – the techniques, policies and pedagogical structure? Can something that is not “infrastructure” in a literal sense be, nonetheless, a “critical infrastructure”? It is an issue that appears from time to time as policymakers try to take inventory as to what constitutes the entirety of a nation’s critical infrastructure. One can easily point to such things as nuclear power plants, bridges, ports and energy plants on the physical side; and crucial IT systems such as SCADA on the cyber side. But if the inventory is to include all “things” that are crucial to the continued functioning and prosperity of a nation, the list could expand – for example international commercial trade regimes, environmental quality and a vibrant education system. This is an issue that is difficult and perhaps evolving, but one important to a nation trying to protect all of its critical infrastructure with limited resources; and more broadly a nation trying to understand itself in terms of what vitally matters. Perhaps it is not the “critical” part that is debatable, only the “infrastructure” part.
There is also a temporal aspect to this issue. If I blow up a nuclear power plant, there are instantaneous, real consequences. Such consequences include the immediate deaths, injuries and destruction caused, as well as the disruption created by the loss of power. There is also the opportunity cost of having to expend resources to control the damage and recover. If the education system were eliminated today, not through an attack on a school or some such event, but rather was simply cancelled, the result would be different. Unlike the nuclear power plant scenario, no one is hurt or killed; no disruption occurs to the functioning of the society at that moment. But what happens when those who now are not educated come of age? The threat manifests itself later, more subtly, as the society collapses under its own ignorance. Again, this is no insight – societies that fail to educate the next generation fall. It is critical that a functioning society maintain a vibrant education system capable of preparing the next generations to become contributing members of the social fabric. But perhaps it is partially this temporal quirk that distinguishes education as “critical” without becoming “critical infrastructure.”
However, perhaps subsections of a national education system can be seen as critical infrastructure. Education is a giant topic; to discuss it is to make reference to a myriad of systems and relationships. Even if we limit ourselves to the public K-12 education system (to reflect the nation’s public role), we are addressing an extremely disparate and diverse entity. But although funding and curricula reflect the realities of local communities, there are certain skills that all school systems recognize as necessary for an individual to actively take part in the economic and political systems of the country. For example, he or she must be able to read. Therefore, without exception, American public schools throughout the country teach students to read. Perhaps herein could lie a glimpse into what part of the overall education system might be “critical infrastructure” – those aspects deemed crucial to an individual’s participation in the larger nation’s economic and political systems. Certainly a failure to be so trained will ultimately cause severe damage to the nation as a whole. However, how do we measure the threat to the nation in terms of numbers? That is to say, how many bad school systems does it take to truly impact the nation? Finally, how far should this go – should agencies responsible for homeland security such as DHS play an active role in curriculum development?
Perhaps a better way to look at the potential role of education as “critical infrastructure” is to ask what direct role it can play in an area already so designated, i.e., cyber security. We can ask what role the education system plays in the furthering of cyber security today. In this light, we can hone in on two very specific aspects of the current efforts to “harden” the US against cyber threats: creating more sophisticated computer users and producing more technology experts.
The cost to the US economy of successful phishing attacks has been estimated at various levels from $150 million1 to $1.2 billion2. Technical strategies have been proposed, studied and in some cases implemented3 in an attempt to stop such activity. However, phishing can also be stopped by sophisticated consumers avoiding the invitations that phishing thieves send out. Here is a role for the public education system that is applicable across the myriad school districts: hardening the cyber network by eliminating the key weapon of phishing perpetrators, i.e. unsophisticated computer users. In this way, education (or at least a specific subsection of it) is transformed into a part of the overall toolbox needed to harden the nation’s cyber network. This particular aspect of the education system becomes not only “critical,” but in its attachment to the protection of the cyber network system, it becomes “critical infrastructure protection.”
Another critical role education plays in the protection of critical infrastructure (in this case both the physical and cyber versions) is the training and development of new experts in engineering, computer science, mathematics and related fields. Without the on-going development of cutting-edge technology experts, the US risks falling behind not only her competitors abroad, but also her enemies at home (or abroad). The personnel portion of critical infrastructure protection is the glue that holds the whole structure together. Without well-trained individuals ready to think about and implement technical, as well as policy, remedies to the threats the nation faces, any attempt to build real critical infrastructure protection regimes and/or technologies will be a non-starter. It is in the creation of a continuous stream of professionals that education’s “critical” nature also stretches into “critical infrastructure protection.”
But there is more to this equation.
"The aim of education is the knowledge not of fact, but of values.” – Dean William R. Inge.
Creating more computer-savvy consumers and more experts in various areas of technology will only contribute to the advancement of critical infrastructure protection if such individuals use such skills and knowledge in a positive way. Training more hackers and teaching people how to better dupe the public through phishing scams certainly will not increase the nation’s cyber security. The question emerges as to whether teaching students how to more sophisticatedly use a computer should be undertaken without also introducing some sort of “ethics” training as well.
Perhaps the issue has come full circle. We began by looking at the education system as a whole as critical to a nation, but not, as a whole, a critical infrastructure. However, looking more closely at some specific examples of education it can be argued that a part of education is, in fact, critical infrastructure: e.g., cyber security through better “computer hygiene” and the training of technology and policy experts. But ethics considerations recall the larger view of education defined as “critical,” but not “critical infrastructure.” The teaching of values and ethics is a broad aspect of education, and one which applies to all things taught, regardless of their relationship to critical infrastructure.
Regardless of the outcome of an examination of this issue, it is beyond dispute that education is an indispensable requirement for a functioning democracy. Without it, society would collapse. Furthermore, education has a specific and immediate role to play in the development of critical infrastructure protection in both the cyber and physical spheres. Although “critical,” perhaps education as a “critical infrastructure” is limited to those specific and immediate roles. In any event, both the critical and the critical infrastructure aspects of the US public education system have important roles to play. Policy makers must remember education’s role in the overall security, both short and long-term, of the nation.
The Critical Infrastructure Protection Program | George Mason University School of Law 3301 N. Fairfax Drive | MS 1G7 | Arlington, VA 22201 Phone: (703) 993- 4840 | Fax: (703) 993- 4847
=
Event(s) Scheduled
=
Today's Date