Royal Army College

Lesson Overview

Earlier lessons taught the officer to read the strategic environment, set out the threat spectrum and the hybrid pressures below open war (Lesson 03), and understand the contest for the cognitive domain, the fight over what a population believes (Lesson 04). This lesson turns from what a society thinks to what it runs on. Beneath the visible life of any modern state lies a layer of systems almost no one notices until one stops: the power that lights a hospital and pumps the water, the networks that carry money and messages, the routes that move food and fuel. These are the critical national infrastructure. They are not separate machines but a single interlocking web, each system leaning on the others, so the loss of one can pull down several in sequence. That web is increasingly digital, which means it can be disrupted without a shot fired or a hand laid on a wire. For a small state, which often depends on a few providers and systems it does not control and holds little in reserve, this is among its gravest exposures.

A word at the outset about scope. This lesson is taught wholly at the conceptual and defensive level. It teaches the officer to understand dependence, see how failure spreads, and think about how a unit and a state are made resilient against the loss of what they rely on. It teaches nothing about how to attack, disrupt, intrude upon, or sabotage any system. That knowledge is no part of the Royal Kaharagian Army's purpose. The Army is a small, lightly armed, humanitarian home-defence force serving the Principality and the Crown, and its interest here is exactly that of a defender: to know what must be protected, to anticipate how it might fail, and to be ready to help keep the nation functioning when it does.

By the end you will be able to define critical national infrastructure and name its principal systems, explain how interconnection brings both efficiency and fragility, trace a cascading failure from a single loss, describe the cyber dimension as a threat to be defended against, explain why a small state is especially exposed, and set out the layers of a resilient response, tying them to the household and national resilience taught in the Emergency Preparedness and Civil Resilience course.

Key Terms

Critical national infrastructure: the systems so essential that their loss would gravely affect national life, public safety, the economy, or the functioning of the state; chiefly power, water and sanitation, communications and the internet, finance and payments, transport, health, and the food and fuel supply.
Critical dependency: a reliance of one system, organisation, or society upon another so close that the first cannot function, or cannot function for long, without the second.
Interdependence: the condition in which critical systems depend not only on the society but on each other, so the web has no simple bottom layer and a failure can travel in more than one direction.
Cascading failure: the process by which one loss removes something a second system needed, causing the second to fail, which removes something a third needed, so a single loss spreads through the web in sequence.
Single point of failure: a part whose loss alone brings the whole system down, because nothing else can take over its function.
Redundancy: the deliberate provision of a spare, a second route, a second supplier, a standby store, or a manual fallback, so the loss of one part does not stop the whole.
Cyber threat: the category of threat in which digital and networked systems are disrupted, spied upon, corrupted, or held to ransom through those networks rather than by physical attack; treated here only as a danger to understand and defend against.
Resilience: the capacity of a system, organisation, or society to prepare for, withstand, adapt to, and recover from a shock; the defensive answer to dependency, carried up from the household level taught in the Emergency Preparedness and Civil Resilience course to the level of the state.

What a modern society cannot do without

A modern society runs on a small number of systems so essential that ordinary life stops when they stop. These are the critical national infrastructure. The first step in defending something is knowing what it is and why it matters, so an officer should be able to name each system and say what its loss would mean.

The sectors are recognisable across every developed state. Power, the electricity supply, comes first and stands apart, because so much else depends on it; a society without power loses far more than light. Water and sanitation deliver clean water and carry waste safely away; their loss threatens health within days, as the Field Health, Hygiene and Sanitation work makes plain. Communications and the internet carry the messages and coordination on which administration, commerce, and emergency response all run; their loss does not inconvenience, it blinds. Finance and payments, the banks and card networks, are how a society buys, sells, and pays wages; when they fail, daily transactions seize up even where goods are present. Transport, the roads, ports, railways, and airfields, moves people and above all goods; a small state with few lines of communication is acutely sensitive to its loss. Health, the hospitals, clinics, and medicine supply, is where the human cost of any crisis is finally paid, and it consumes all the systems above. The food and fuel supply is the slow but absolute foundation beneath everything else.

Hold them in one view, because the officer's habit is to see the whole and not a list:

   THE CRITICAL NATIONAL INFRASTRUCTURE
   (the systems a modern society cannot function without)

     POWER                the electricity supply; almost everything
                          else leans on it

     WATER & SANITATION   clean water to the tap; safe removal of waste

     COMMUNICATIONS       telephone, internet, data; the coordination
     & THE INTERNET       of administration, commerce, and response

     FINANCE & PAYMENTS   banks, card networks, the movement of money

     TRANSPORT            roads, ports, rail, air; the movement of
                          people and, above all, goods

     HEALTH               hospitals, clinics, the supply of medicines

     FOOD & FUEL SUPPLY   the chains that feed a society and power it

Two features matter more than the list. First, the systems are not equal: power and communications sit beneath the others in a way water or transport do not, so their loss reaches furthest. Second, no system stands alone. The real danger lies not in the systems in isolation but in the web that joins them, so we turn to that next.

The web beneath modern life: critical dependencies

A society does not depend on its critical systems one at a time. It depends on all of them at once, and they depend on each other. This is the conceptual heart of the lesson. A critical dependency is a reliance so close that the dependent thing cannot function, or cannot function for long, without what it relies on. Modern life is built on long chains of such dependencies, each link handing on to the next.

Trace one ordinary act and the chains appear. A family buys food at a shop. The shop has food because lorries delivered it; the lorries ran on fuel; the fuel reached the station through a chain that needed power and transport; the tills, card terminals, and lighting all ran on electricity; the payment cleared because finance and communications were working; and the food was safe because the cold chain never broke, which again was power. One unremarkable purchase rests on power, fuel, transport, communications, and finance all functioning together, and the buyer notices none of it until a link breaks. Trace a hospital admitting a patient, an officer drawing supplies, or a national paying a bill, and it ends in the same place: a few key systems, deeply interlinked.

This interlinking is interdependence, and the dependencies do not all run one way. Power needs communications to manage the grid; communications need power to run. Transport needs fuel; the fuel supply needs transport to move it. There is no simple bottom layer on which everything rests, but a web in which failure travels in more than one direction. That web gives modern life its efficiency, because each system specialises and leans on the others rather than providing everything itself. The same trade brings fragility, and the officer must hold it in mind throughout. A society of many short, self-sufficient parts is inefficient but hard to bring down whole; a society of long, interconnected chains is efficient but exposed, because a break anywhere is felt everywhere. A modern state has chosen, mostly without deciding to, a great deal of the first and so a great deal of the second.

This is the strategic-level form of the same idea the Emergency Preparedness and Civil Resilience course teaches at the level of the home. Its Lesson 04, on coping without services, names the supplied services a household depends on and shows their loss as the common face of most emergencies. This lesson lifts that insight to the scale of the nation. A household that understands why it stores water and keeps a means of light has grasped, in miniature, the whole of what follows.

Cascading failure: how one loss becomes many

If a society rests on an interdependent web, the loss of one system does not stay where it begins. It removes something a second system needed, so the second fails; that removes something a third needed, so the third fails; and the original loss spreads through the web in sequence. This is cascading failure. Understanding it is the difference between expecting a single problem and being ready for the several that any one problem brings.

Power is the clearest case, and the one the officer should keep ready as the standard example. The Emergency Preparedness course teaches the household version: a single power cut taking light, cooking, heating, refrigeration, and charging at once. At the scale of a district or nation the cascade runs wider. When power fails across an area, the water supply may fail with it, because the mains pumps are electric; sanitation may fail, because the sewage pumps are electric too. Communications begin to fail as masts and exchanges exhaust their few hours of battery. Payments fail, because tills, card networks, and cash machines need power and communications together. Fuel becomes hard to draw, because the station pumps are electric, which in turn starves the standby generators meant to bridge the gap. Health strains as hospitals fall back on generators and watch their fuel, and the cold chain for medicines weakens. Transport degrades as signals and fuel both falter. One loss has become six or seven, and each now feeds back on the others.

Seeing the cascade drawn is what turns a vague dread into a clear understanding of what must be made resilient:

   A CASCADING FAILURE FROM THE LOSS OF POWER
   (one initial loss spreads through the interdependent web)

                       [ POWER LOST across an area ]
                                   |
        +-----------+-----------+--+--------+-----------+-----------+
        |           |           |           |           |           |
      WATER     SANITATION  COMMUNICATIONS PAYMENTS    FUEL       HEALTH
   (electric   (sewage     (masts and    (tills,    (station    (hospitals
    pumps      pumps        exchanges     card nets,  pumps are   on standby
    stop)      stop)        on hours of   cash points electric;   power;
        |          |        battery)      all need    generators  cold chain
        |          |            |         power)      starve)     weakens)
        v          v            v            v           v           v
   +--------------------------------------------------------------------+
   |  and now the failures feed EACH OTHER: without communications the  |
   |  power crews are slower to coordinate repairs; without fuel the    |
   |  generators that bridged hospitals and masts run dry; without      |
   |  payments and transport, food and fuel stop reaching the area.     |
   +--------------------------------------------------------------------+
                                   |
                                   v
              ONE loss becomes a general degradation of daily life,
              and recovery is slowed because the systems that would
              fix one are themselves down. THIS is why resilience
              must be built BEFORE the loss, not improvised after it.

Two lessons sit inside the figure. The first is sequence: the failures unfold over hours and days, each triggered by the last, which leaves a window in which good preparation and quick action can break the chain before it runs its length. The second is feedback: because the systems depend on each other, the failures do not merely add up, they slow their own repair, the loss of communications hampering the crews who would restore the power, the loss of fuel draining the generators meant to bridge the gap. That is why a well-advanced cascade is so hard to arrest, and why resilience must be built before the loss. Hybrid pressure, the subject of Lesson 03, is dangerous in exactly this light: an actor who understands the web can aim a small, deniable disruption at one key system and let the cascade do the rest, achieving a wide effect from a narrow act.

The cyber dimension: disruption without a physical attack

The systems described so far are physical things, pumps and masts and lorries. But they are increasingly run by digital controls and joined by networks, and that changes the threat. A modern grid, water system, payment network, or transport system is managed by computers and connected, directly or indirectly, to wider networks. That connection brings remote monitoring, faster coordination, and efficiency. It also means these systems can in principle be reached, disrupted, spied upon, corrupted, or held to ransom through those networks, without any physical attack at all. This is the cyber dimension of critical infrastructure.

The boundary here must be stated plainly, and the officer is to respect it absolutely. We teach what the cyber threat is, so it can be anticipated and guarded against. We teach nothing about how it is carried out: no method, no technique, no tool, no instruction of any attacking kind anywhere in this course. The Royal Kaharagian Army is a defensive, humanitarian force, and such knowledge serves no lawful purpose it has. The officer's need is to understand the cyber threat as a defender understands a flood or a fire: well enough to prepare for it, recognise it, protect against it, and respond when it comes, and not one step further.

As a category, the cyber threat has features that matter for the small-state defender. It acts at a distance, so the actor need not be near the system or even be a state; the same category covers criminal groups seeking ransom and others seeking only disruption. It is deniable, leaving uncertain who was responsible and even whether an incident was attack or accident, which places it squarely among the sub-threshold hybrid pressures of Lesson 03. It is patient, since a system may be quietly compromised long before any effect shows. And, most important, it can reach the very infrastructure whose dependencies we have traced, so a cyber action against one key system can set off exactly the cascade above, achieving a society-wide physical effect through a purely digital act. The cyber threat is dangerous not as a thing apart but because it is another way into the critical web, and the interdependence that makes a physical loss cascade makes a digital one cascade too.

Two points follow for the RKA. First, the Army is overwhelmingly a consumer and protector here, not a cyber actor: it keeps its own systems and communications sound, follows good discipline so it is not the weak link, and, where tasked, helps protect the physical infrastructure on which the digital systems ultimately sit. Second, the cyber threat is folded into the same resilience thinking as every other threat, planned for and rehearsed around, not treated as a separate and mysterious domain. The information discipline of Lesson 04, the habit of not becoming an unwitting channel, is part of this defence, because the human is so often the way into a system. The defensive answer to the cyber threat is the same answer as to any other dependency, and it is to resilience we now turn.

Why a small state is especially exposed

Everything said so far is true of any modern society, but a small state carries these exposures more heavily, and the officer must understand why, because it shapes what resilience must do. This is the course's governing idea, that a small state's strategic position is a different problem and not a scaled-down version of a great power's, applied to infrastructure.

A small state is more exposed for several connected reasons. It often depends on a few providers rather than many, so a single supplier's failure removes a whole service with no second source ready; where a large state has many power stations, ports, and suppliers, a small one has a handful, and the loss of one is the loss of a large fraction. It often depends on systems it does not control, drawing power, fuel, data, finance, or goods across its frontier, so a disruption upstream reaches it without anything having gone wrong inside its own borders. It has little redundancy and little reserve, because spare capacity and large stores are expensive and a small economy affords fewer; the buffer that carries a large state through a shock is thinner or absent. And its small scale means a single point of failure is more likely to be one on which the whole nation depends. The Basic Training Manual names this in Kaharagian terms: a small number of port facilities, a limited number of substations, a handful of telecommunications nodes, and the road network linking them, assets that are, in its phrase, short and identifiable. What makes them identifiable to a defender makes them identifiable to anyone, and what makes them few makes each one matter.

   WHY A SMALL STATE IS MORE EXPOSED
   (the same web, but with thinner margins)

   LARGE STATE                          SMALL STATE
   -----------                          -----------
   many providers, suppliers,           few providers; the loss of one
   stations, ports, routes              is the loss of a large fraction

   mostly controls its own systems      depends on systems across its
   within its borders                   frontier that it does not control

   spare capacity, second routes,       little redundancy, little reserve;
   large stores: a thick buffer         a thin buffer or none

   a single failure may hit one         a single failure may hit the
   region of many                       whole nation at once

This is not counsel of despair. It is the diagnosis that makes the defensive response possible, because a small state's very smallness is also part of its answer: it has few enough key systems to know them all, understand their dependencies in detail, and concentrate its resilience where it matters most, in a way a sprawling state cannot. It cannot match a large state in mass or spare capacity, but it can match and exceed it in understanding and focused preparation. That is the small-state discipline this course teaches: precision and foresight standing in for mass.

The defensive response: building resilience

The whole lesson leads to one practical end, the building of resilience, the defensive answer to dependency, interconnection, and the cascade. Resilience means here what it means in the Emergency Preparedness and Civil Resilience course, the capacity to prepare for, withstand, adapt to, and recover from a shock, applied to the critical systems of the state. It is not the prevention of all failure, which is impossible, but the containment of failure, so the loss of one thing does not become the loss of everything, and what is lost can be restored. It is built in layers, and the officer should hold all of them together.

The first layer is to reduce single points of failure. Where a whole service rests on one component, supplier, route, or node, that is where the cascade begins; the work is to find these points by tracing dependencies as this lesson has done, and remove the worst, so no single loss is enough by itself. The second is to build redundancy and manual fallbacks: a second route, a second supplier, a standby store, a fuel reserve, and, crucially, a way to do the essential thing by hand when the automatic system fails, paper records when the database is down, cash when the card network is down, a manual valve when the controller is down. Redundancy is expensive, so a small state concentrates it where the cascade would be worst, on power, water, and communications first. The third layer is to harden and protect the key systems, both physically, the guarding of critical nodes that the Aid to the Civil Power and Public Order course treats as key-point protection, and digitally, the practice and discipline that keep systems sound; this is where the Army's tasked role most often sits. The fourth is to plan for the loss: to decide in advance what is done when a key system fails, who leads, how the public is told, and how essentials keep running without it, so the response is a prepared sequence and not an improvisation in the dark. The fifth, which gives the others their edge, is to rehearse operating without them, so households, services, units, and the state have done the thing once and do not meet it cold.

   THE LAYERS OF RESILIENCE THAT CONTAIN A CASCADE
   (read from the outside in: each layer holds the failure a little more)

   +------------------------------------------------------------+
   |  REHEARSE operating without the system                      |
   |  +------------------------------------------------------+   |
   |  |  PLAN for the loss: who leads, how the public is     |   |
   |  |  told, how essentials run without it                  |   |
   |  |  +------------------------------------------------+   |   |
   |  |  |  HARDEN and PROTECT the key systems            |   |   |
   |  |  |  (key-point protection; good digital practice) |   |   |
   |  |  |  +------------------------------------------+   |   |   |
   |  |  |  |  BUILD REDUNDANCY and MANUAL FALLBACKS   |   |   |   |
   |  |  |  |  (second route/supplier, stores, paper,  |   |   |   |
   |  |  |  |   cash, manual valves)                   |   |   |   |
   |  |  |  |  +------------------------------------+   |   |   |   |
   |  |  |  |  |  REDUCE SINGLE POINTS OF FAILURE   |   |   |   |   |
   |  |  |  |  |  (find them by tracing the web;    |   |   |   |   |
   |  |  |  |  |   remove the worst)                |   |   |   |   |
   |  |  |  |  |          [ KEY SYSTEM ]            |   |   |   |   |
   |  |  |  |  +------------------------------------+   |   |   |   |
   |  |  |  |  the loss is contained here if it can be |   |   |   |
   |  |  |  +------------------------------------------+   |   |   |
   |  |  +------------------------------------------------+   |   |
   |  +------------------------------------------------------+   |
   +------------------------------------------------------------+

   A failure that breaches one layer is caught by the next; the
   deeper the layers go before the loss, the shorter the cascade
   runs after it.

These layers are not the Army's to build alone, and here the lesson rejoins the whole-of-society model the Emergency Preparedness and Civil Resilience course sets out in its Lesson 08. Resilience against the loss of critical systems is built in the same layers as every other: the household first, ready to cope without services for the first days exactly as that course's Lessons 03 and 04 teach; the community next, neighbours who carry one another through; then the operators and civil authorities, who run and protect the systems and lead the response; then the state, which sets the plans, holds the reserves, and directs the national effort; and the Army within them all, in support and never in charge. The household that has stored water and light is the innermost defence against the very cascade traced here, because a population that can carry itself through the first days of a power loss does not immediately overwhelm its critical services, and so gives the cascade a chance of being contained.

The Army's place is the supporting one this College teaches throughout, and it touches the work in three honest ways. It protects, where lawfully tasked, the physical key points on which the systems rest, under the civil authority and by the principles of the Aid to the Civil Power and Public Order course. It sustains the response when a system has failed and the civil services are overwhelmed, bringing disciplined, organised hands to keep essentials moving, the same humanitarian task the Emergency Preparedness course's Lesson 08 describes. And it keeps itself resilient, so it can act when the systems it depends on, power, fuel, communications, are themselves degraded. What the Army does not do is run the nation's infrastructure or take charge of its protection; that belongs to the operators, the civil authorities, and the state, and the Army's strength is added at the margin. This whole picture, of infrastructure and cyber resilience as one strand of a society defending itself together, is the subject of Lesson 06, on comprehensive security and whole-of-society defence, into which this lesson feeds directly.

In Practice: The District That Kept Its Feet

A coordinated disruption falls on a generic coastal district of the Principality. Late on a winter afternoon the power drops, and within the hour it is clear this is no ordinary fault: the loss is wide, the cause is uncertain, and a rumour is already running that it was no accident. To an officer who has studied this lesson, the situation is legible. The loss of power is the head of a cascade, and the question is how far down the chain the failure will be allowed to run before it is contained.

Watch the layers work. In the prepared households, families fall back on what the Emergency Preparedness and Civil Resilience course taught them: stored water drawn before the taps could fail, light that needs no mains, one warm room against the cold, a wind-up radio for official news, and not one fuel-burning device brought indoors. Because those households carry themselves through the first day, the demand that would have swamped the civil services in the first hours never arrives, and the cascade is robbed of its fastest accelerant. The water utility, which had identified its electric pumps as a single point of failure and provided standby power and a manual fallback, keeps clean water flowing where an unprepared utility would already have lost it. The few telecommunications nodes hold on their batteries while operators race to refuel the generators. The civil authority, leading as it must, opens warm centres and broadcasts plain, steady information on the official channel, the cognitive-domain discipline of Lesson 04 in action, so the rumour of sabotage finds less empty air to fill.

The Army's part is small and exact. At the lawful request of the civil authority, a platoon helps protect two key infrastructure nodes, under police primacy and by the key-point principles of the Aid to the Civil Power and Public Order course, freeing the operators to concentrate on restoration. Another section, drawn from members who live in the district, spends the first hours simply as good neighbours, looking in on the elderly and the alone. The Army runs none of the systems and takes charge of nothing; it adds its hands at the margin, exactly where the civil effort is thinnest.

The lights come back in two days. No single act in the whole of it was heroic, and that is the point. The district kept its feet not because the failure was prevented, it was not, but because the cascade was contained layer by layer, by resilience built in advance: households ready to cope, utilities that had covered their single points of failure, a civil authority with a plan and a clear voice, and a small Army adding its strength where it was needed and nowhere else. A district with none of that readiness would have met the same loss as a spiralling disaster: the water gone, the public blind and frightened, the rumour unchallenged, the services overwhelmed in the first hours. The whole difference is the work this lesson has described, done before the loss and not after it.

Check Your Understanding

Name the principal systems of a nation's critical national infrastructure, and explain why power and communications matter more than the others. What is a critical dependency, and why does the interconnection that brings a modern society its efficiency also bring it fragility?
Explain what a cascading failure is, and trace one from the loss of power across a district, naming at least four systems drawn down in sequence. Why does the feedback between failing systems make a well-advanced cascade so hard to arrest, and what does this tell you about when resilience must be built?
Describe the cyber threat to critical infrastructure as a category to be understood and defended against, and explain why it is dangerous precisely because of the interdependence traced earlier. Then set out why a small state is especially exposed, and name the layers of the resilience response that contain a cascade.

Reflection (write a short paragraph): Think of the critical systems a generic small state most depends on, and of the dependencies that join them. Where would you look first for the single points of failure on which a whole service rests? Of the five layers of resilience, reducing those points, building redundancy and manual fallbacks, hardening and protecting, planning for the loss, or rehearsing without it, which do you judge a small state can least afford to neglect, and why? How does the readiness of an ordinary household, taught in the Emergency Preparedness and Civil Resilience course, connect to the resilience of the nation as a whole?

Summary

Critical national infrastructure is the set of systems a modern society cannot function without: power, water and sanitation, communications and the internet, finance and payments, transport, health, and the food and fuel supply. Power and communications matter most because so much else leans on them.
These systems depend on each other as well as on the society, through long chains of critical dependencies. This interdependence is what gives modern life its efficiency, and the very same interconnection is what gives it its fragility.
A cascading failure is the spread of one loss through the web: the loss of power, the standard example, can draw down water, sanitation, communications, payments, fuel, and health in sequence, and because the systems depend on each other the failures slow their own repair. This is why resilience must be built before the loss.
The cyber dimension is that these systems are increasingly digital and so can be disrupted, spied upon, or held to ransom without a physical attack. It is taught only as a threat to understand and defend against, never as a method, and it is dangerous because it is another way into the critical web. It sits among the hybrid pressures of Lesson 03 and is answered by the same resilience and the information discipline of Lesson 04.
A small state is especially exposed because it depends on few providers and on systems it does not control, holds little redundancy and reserve, and may rest the whole nation on a single point of failure. Its answer is not mass but the discipline of understanding its few key systems in detail and concentrating resilience where it matters most.
The defensive response is resilience built in layers: reduce single points of failure, build redundancy and manual fallbacks, harden and protect the key systems, plan for the loss, and rehearse operating without them. This is the strategic form of the household and national resilience taught in the Emergency Preparedness and Civil Resilience course; the Army's part is to help protect key points, sustain the response when systems fail, and keep itself resilient, always under the civil authority. The whole picture is drawn together in Lesson 06, on comprehensive security and whole-of-society defence.

Cyber, Infrastructure, and Critical Dependencies