Co-Investigator
Infrastructure supports many of the activities we do on a daily basis and most of the time we take it for granted that it will work as and when we need it. However, Covid-19 has meant some key infrastructures have come under pressure with unexpected increased use, while others have become inaccessible.
When infrastructure is disrupted, there are often workarounds that spring up to allow people to achieve what they set out to do, whether that be using the internet to communicate, finding transport options under lockdown or accessing and using supply chains. In this project, we call these ad-hoc workarounds ‘shadow infrastructures’. Shadow infrastructures have the potential to be beneficial and drive innovation but they can also provide security risks and opportunities for increased criminal activities.
This project aims to better define the concept of ‘shadow infrastructures’ by using case studies about shadow criminal networks, transport networks, power infrastructure and post-COVID supply chains. By involving SPRITE+ project partners and industry stakeholders, this project will allow trust, identity, privacy and security (TIPS) considerations around shadow infrastructures to gain a broader awareness in real-life settings. Our team draws on expertise from engineering, transport studies, global development, sociology, and policing.
Shadow infrastructures allow users to perform tasks when formal infrastructures are unavailable or infeasible to use, e.g., at times of crisis. While providing this resilience, shadow infrastructures are not officially supported, may introduce new vulnerabilities, or even be illegal to use. An Excel macro may help an employee work faster, but it may also introduce vulnerabilities that allow attackers to gain access to the employee’s computer; using familiar software licenced for personal use may speed up the work but break the terms of that licence.
Shadow infrastructures typically arise from the bottom up, while formal infrastructures are typically provided from the top down. The bottom-up nature of shadow infrastructures may present difficulty for anyone trying to manage their company’s assets, map and assess risks, or conduct an audit to ensure compliance.
Given the emergence of shadow infrastructures, it helps to plan, map, and identify them, especially when it comes to critical national infrastructure. While shadow infrastructures may allow or improve work performance, they may also bring vulnerabilities which are not accounted for in risk modelling and audits. It is important to understand that shadow infrastructures emerge from people’s need to solve specific problems, where they find official infrastructures inadequate for their needs. This may be both employees finding better tools to solve their problems, or it may be to facilitate illegal activities where formal infrastructures do not allow criminal activity.
This project’s impact is in building an awareness of new types of infrastructure, and the need for professionals (managing critical national infrastructure, organisational infrastructure and within policing) to incorporate these ideas into their programs and plans.
This project is innovative, because it explores the impacts of COVID-19 on the digital economy in a more holistic way, by exploring the interconnected, and often bottom-up, impacts of new technologies and practices.
The project’s next steps involve answering the question of how to build resilient infrastructures in the context of crisis, where formal infrastructures may be unavailable or infeasible. This involves looking across cybersecurity, critical infrastructure, digital economy, and crime as cross-cutting areas where shadow infrastructures are likely to emerge and need to be managed.