Various societal functions ensure the every-day life, survival and progress of modern societies, such as healthcare, freight transports, water supply and electricity. To protect such critical societal functions, i.e. critical infrastructures, and to maintain them under disturbances, for example electrical power failures, national emergency response planning requires a comprehensive information processing. This information processing involves the procurement, the transition and the utilisation of the information and its content. The quality of the processed information finds itself constantly confronted with various requirements, such as the needs of the involved decision-makers, the demands of national and international information security policies and the expectations of the various actors that are concerned with critical infrastructure protection and crisis management.
With evidence from the Swedish planning process for prioritising critical infrastructure during a national power shortage situation, called Styrel, the study aims to crystalize information paths and flaws to highlight information filtration and alteration. For this purpose, the study investigated publicly available documents regarding the Styrel process and conducted interviews with entrusted decision-makers at County Administrative Boards, municipalities and power grid providers to track the formal and informal information flows.
This study clarifies and models the information processing throughout the currently implemented national decision-making process to retrieve deficiencies in the planning for critical infrastructure protection. The analyses of the collected material reveal a set of information flawing filters, such as information withhold in sharing, information loss when sharing, information scarcity in criticality assessments, and ad-hoc information creation due to scarcity. Due to these filters, the Swedish process cause an information altering that affects the quality of both the decisions made and the resulting emergency response plan that relies on them. Thus, this study indicates deficiencies related to information sharing, information security, and decision-making that pose risks to citizens and businesses who depend on the maintenance of critical infrastructure. The results further inform suggestions for possible changes in the information processing, which also regards information security concerns and an enhanced risk communication.