Modern warfare is forcing a convergence between national and corporate security—and no one is sure who is responsible for the cost of paying to protect businesses.
In its war with the U.S. and Israel, Iran didn’t limit its attacks to military assets; it hit oil refineries and tankers stranded in the Persian Gulf as well as petrochemical facilities, civilian airports, aluminum smelters, water-desalination plants and Amazon data centers. In recent years, Ukrainian power stations, American utilities and subsea cables from the Baltic Sea to Taiwan have also all become targets.
While civilian infrastructure has long been a target in wartime, the increasingly networked world means business assets hold growing military value. In the new age of warfare, businesses are finding that the facilities they have designed for low-cost and easy maintenance need more protection—and often the kind only militaries have traditionally provided.
Across volatile regions, some critical infrastructure, like desalination plants and data centers, will need to be fortified with layers of reinforced concrete, duplicated to provide backups or potentially relocated underground—at significant cost. Arguments are already brewing between companies and governments over new regulations and potential costs.
In Germany, powerful associations representing private companies and municipal utilities have pushed back against new standards for physical protection, warning they could spell financial ruin. New Zealand’s government has faced resistance from industry groups over a proposal to fine critical-infrastructure companies and their directors for cybersecurity breaches.
“We’ve been spoiled for too long by peace,” said Norman Heit, global corporate security and resilience director at telecom giant Vodafone. “People don’t appreciate that physical security for businesses is a public good, like defense.”
A sign of how lines are blurring: The North Atlantic Treaty Organization’s 32 countries last year agreed that as part of a pact to spend 5% of economic output on defense and security, 1.5% would go to military-adjacent needs including protecting critical infrastructure and networks. Spending targets range from cybersecurity and industrial capacity to railroads, bridges and ports needed for military logistics. Progress on those efforts will be a focus when leaders gather for a NATO summit on July 7 in Turkey.
“We need a wide concept of defense—defense is no longer just military,” said Italian Adm. Giuseppe Cavo Dragone, NATO’s top military adviser.
Adding to the complexity, companies now need to protect the data networks that serve as gateways to critical infrastructure. Hackers increasingly target not just computer files to steal information but also systems managing vital functions like building access and factory control, remotely causing physical damage or enabling espionage.
U.S. authorities in April warned that Iranian hackers were trying to disrupt American drinking-water systems by targeting computer equipment that connects hardware with software. A year earlier, suspected Russian hackers remotely manipulated valves on a Norwegian hydroelectric dam.
“Digital attacks on physical systems create physical problems,” said Gianni Cuozzo, chief executive of Exein, an Italian startup that embeds security software into microchips used in devices from televisions to vending machines and ventilation systems.
Another challenge will be parsing jurisdictions and liability for assets that cross international waters or are damaged in combat—such as subsea data cables or energy pipelines. Turf battles between law enforcement and militaries are already complicating efforts.
When suspected Russian drones swept over European airports last year, governments struggled to clarify who should respond. Following a spate of drone flights over industrial and security sites in Germany, the government earlier this year gave the military more authority to deal with drones in areas normally controlled by local law enforcement.
“The private owner can invest in redundancy, monitoring, and repair capacity, but only governments and militaries can really deter, patrol, attribute, or respond to hostile state activity,” said Marc Glasser, who worked on cybersecurity and infrastructure security for three decades at the U.S. Department of Transportation and the Department of Homeland Security.
Noel Hacegaba grapples with these concerns daily as chief executive of California’s Port of Long Beach. He sees new technologies and their use by hostile, state-aligned actors redefining the threats facing the port, which is among America’s busiest, handling $300 billion in cargo annually.
“Everything that we do has to be viewed from a security lens,” he said.
Few businesses are more old-world than seaports, but cargo handling has gone digital. Hacegaba in May launched a cyber-defense operations center to thwart tens of thousands of cyberattacks daily, which jeopardize computer systems and all equipment connected to them.
“Five years ago, port security was mostly about people and freight. Today, it’s about people, freight, software, hardware and airspace all at once,” he said. “A cyber incident on a Tuesday, a drone on a Wednesday, a geopolitical shock on a Thursday and they all touch the same asset by Friday.”
The scale of the threat is prompting calls to elevate responsibility for corporate security to the C-suite, in the same way that the financial upheaval of the 1990s pushed money managers to the CEO’s side. Executives and business-risk experts in March published a call to action in the Harvard Business Review titled “The Case for Hiring a Chief Resilience Officer.”
Proponents say those officers need to be at the boardroom level because of the huge potential liabilities from business disruptions and costs of complying with new regulations.
Companies say they need greater clarity from governments on what protections they will provide and subsidies to help them defend privately owned assets that provide a public good.
Most governments don’t provide incentives for companies to invest more than the minimum legal resilience requirements. That will likely make it an area for competition among businesses, said Heit at Vodafone, and the companies that are able to invest will win out by touting their resiliency as a benefit to clients.
“If companies are expected to support the state to protect critical infrastructure, they need to be incentivized to do that,” Heit said. Vodafone and eight other telecom-related companies last year called on European authorities and NATO to boost public support and government coordination in protecting subsea cables.
Regulations are starting to change. The European Union adopted new ones after Russia’s full-scale invasion of Ukraine, requiring countries to reduce vulnerabilities. National risk assessments and lists of critical entities are due this month, but many states are behind schedule.
New proposed laws in the U.K. seek to increase penalties for subsea sabotage, updating codes that date to when telegraph cables were first laid in the 19th century.
In the U.S. and other parts of the world, new requirements are either being enacted or coming into force, though often more focused on specific sectors like energy and finance than across an entire economy, say specialists. Congress established the Cybersecurity and Infrastructure Security Agency in 2018 to assist other government agencies and private-sector organizations, but its budget and staff have shrunk in recent years.
The latest efforts echo what happened in response to the Sept. 11, 2001, terrorist attacks, when airports that were designed for efficiency and ease of travel upended operations to give priority to security. The U.S. restructured the federal government and pumped hundreds of billions of dollars into homeland security.
Now, nearly every type of facility is a potential target. Iranian drone attacks in March took out data centers in the United Arab Emirates and Bahrain that had been used for banking and other commercial purposes. They remain offline, part of a series of warning signs flashing around the world as the growing reliance on artificial intelligence makes data centers indispensable.
“It’s better to learn these lessons now than down the road,” said Sam Winter-Levy, fellow in the Technology and International Affairs Program at the Carnegie Endowment for International Peace.
Write to Stephen Kalin at stephen.kalin@wsj.com and Daniel Michaels at Dan.Michaels@wsj.com
