Urban resilience in the making? The governance of critical infrastructures in German cities

Abstract

Over the last decade, the protection of urban infrastructures has become a focus in German security policies. These point not solely to the multiple external infrastructural threats (e.g. natural disasters, terrorist and cyber-attacks), but also to the endogenous risks of cascading failures across geographical and functional borders that arise from interlocking and often mutually dependent infrastructures. As geographical nodes in infrastructurally mediated flows, cities are considered to be particularly vulnerable to infrastructure breakdowns. Their capability to prevent and to prepare for infrastructural failures, and thus to manage infrastructural interdependencies, is seen as a major prerequisite for resilient societies. However, as our article demonstrates, the institutional capacity of the local authorities and utility companies for risk mitigation and preparedness is limited. Drawing on qualitative research in selected German cities, we argue that the governance of critical infrastructures involves considerable challenges: it overarches different, often fragmented, policy domains and territories and institutionally unbundled utility (sub-) domains. Moreover, risk mitigation and preparedness are usually not based on experience from past events, but on destructive scenarios. They involve considerable uncertainty and contestations among local decision-makers. Interviews with local experts indicate that effective governance of critical infrastructures requires more regulatory efforts by national policies. At the same time, they point to the need for identifying and assessing place-based vulnerabilities, for defining locally differentiated mitigation and preparedness strategies and for the training of local utility companies as well as crisis management.

Introduction

There is little doubt regarding the need for the smooth operation of urban infrastructure systems. Their seamless functioning embodies the self-image of cities of the global North and their state of technical, social and political stability. In recent years, however, infrastructure vulnerabilities have become the focus of security policies. This attention to the concept of ‘critical infrastructures’ can be traced to the 1990s, highlighting the risks of infrastructural disruption or impairment that ‘would trigger a detrimental shortage of supplies, a substantial disruption of public security, or similar dramatic consequences’ (BMI, 2009: 3). First used as part of the United States’ homeland security terminology, the concept of critical infrastructure protection gained priority in counterterrorism activities starting after 9/11 and soon found its way to Europe (European Commission, 2006). In Germany, the Ministry of the Interior has developed a national strategy of critical infrastructure protection and has promoted its implementation – apart from legislation regarding ICT security – through voluntary cooperation among governments, businesses and civil society (BMI, 2009). The ways that this security strategy works in practice, along with how it is adapted and institutionalised in urban contexts, however, has hardly been substantiated. This is surprising, since the challenges resulting from increased infrastructural vulnerability inevitably translate into urban challenges.

First, the growing techno-scientific character of modern cities as the physical nodes in the infrastructurally mediated flows of water, energy, waste, communication, people, goods and services makes them more dependent on the functioning of multiple interconnected infrastructures. The high density of people, the strong dependency of urban residents on the seamless functioning of infrastructures ¹ and the higher susceptibility to terrorist threats make cities particularly vulnerable to infrastructural breakdowns or attacks. Their failure, e.g. a power blackout or cyberattack, can manifest far-reaching risks to urban safety and considerable interruptions of urban lives, economic systems and the functioning of other infrastructures (Boin and McConnell, 2007; Petermann et al., 2011). Particularly, cities that have increased the reliability of their infrastructures are paradoxically often becoming more vulnerable to their interruptions (‘vulnerability paradox’).

Secondly, the perception of an increased vulnerability of urban infrastructures through new exogenous as well as endogenous risks drives debates on critical infrastructure protection. Exogenous risks include, for example, more frequent and more severe extreme weather events due to climate change or terrorist and cyberattacks. Endogenous risks are triggered by the increased complexity and interdependency of infrastructure systems. While individual urban infrastructure (sub)sectors have been institutionally and spatially unbundled and disintegrated (Graham and Marvin, 2001), their functioning is interdependent in highly complex ways. Cities are not only characterised by a high spatial density of networks and flows but can be seen as complex systems of infrastructure systems characterised by various interfaces and a tight coupling between individual infrastructure domains. While interconnected networks underpin the ceaseless flows of city life in various ways and bring about efficiencies during normal operations, they also create risks of cascading infrastructural failures. As urban infrastructures become interconnected and dependent on each other and as new infrastructural nexuses emerge (e.g. electric mobility, ‘waste2energy’, ‘power2gas’, dry sanitation solutions), their complexity and tight coupling enable relatively small disturbances to escalate rapidly into compound multi-infrastructural crises (Boin and McConnell, 2007; Perrow, 1984). Such ‘cascading failures’ can reach beyond traditional functional and geographical borders (Little, 2010; Rinaldi et al., 2001; Vertesi, 2014) and involve ‘interactions, combinations, feedback loops, higher-order consequences, and links across the system boundary’ (Lovins and Lovins, 2001: 19). Increased socio-technical interconnectedness within and across cities, together with modern reliability cultures, can thus paradoxically translate into increased urban vulnerabilities in case of failures.

Thirdly, cities have important competencies in civil protection, crisis management and the governance of infrastructures and thus have major responsibilities in the protection of critical infrastructures. However, city governments or utility companies cannot know every conceivable ‘worst case’ that may happen – terrorists might become inventive or climate change might unfold differently than predicted. The challenge is thus increasingly not solely seen in reducing the likelihood of failures and the extent of their damage, but also in increasing the social and technical preparedness and resilience needed to handle infrastructure failures and to mobilise flexible responses to disruptions (Coaffee and Clarke, 2017; Collier and Lakoff, 2008; Medd and Marvin, 2005).

Accordingly, there is a general consensus on the criticality of technical infrastructures for urban security and life, the increasing vulnerabilities of infrastructures and the need to foster activities to mitigate the risk of infrastructural failures, and to prepare for them. The notions of vulnerability and resilience are thus rapidly gaining ground in both urban studies literature (e.g. Brown, 2014; Meerow et al., 2015) and in the study of technical infrastructure (e.g. Bijker et al., 2014; Kröger and Zio, 2011), pointing to the need for new governance arrangements. In a similar vein, policy debates highlight core principles of resilience within urban policy and planning. These include: the preparedness by all individuals and organizations, the clarification of their roles and responsibilities, an agreement of all organized stakeholders on strategic aims, supporting objectives and instruments, an effective co-ordination and cooperation within and between organizations and tiers of response, an appropriate guidance and support for the local or regional level, established communication structures and information sharing, risk identification and analysis that guides anticipatory planning (see UK Resilience Guidance in Coaffee, 2013: 324). However, as we point out, the place-based exposure of cities to infrastructural threats, and the urban governance challenges in detecting, preventing and preparing for infrastructural disruptions, have not yet attracted much attention in urban policymaking and the urban practices of utility companies in Germany.

Our article focuses on the complex institutional arrangements and the ‘messy’ practices in the governance of critical infrastructures in German cities. We ask if and how local administrations and utility companies acquire the necessary knowledge and devise coordinating strategies in critical infrastructure protection. Based on an overview of relevant debates on urban and infrastructural resilience, we suggest that local administrations, utility companies and crisis management agencies are confronted with unprecedentedly complex tasks. Their double challenge is to mitigate the likelihood of infrastructural failures and the extent of their damage and to increase the preparedness and resilience needed to handle them. Our empirical study is based on literature and documentary analyses, qualitative interviews with 48 experts and workshops with practitioners from local utility companies and crisis management. In this study, we point to the numerous public and private stakeholders, the low level of institutionalisation, the limited regulatory capacity of the (local) state, the specially challenging information requirements and the conflicts over both the nature of the problems and their effective and cost-efficient solutions. We conclude by indicating that the governance of critical infrastructures requires more regulatory efforts by national policies. At the same time, we point to the need for identifying place-based vulnerabilities, locally differentiated preparedness strategies and the training of local utility companies as well as crisis management.

Challenges to the urban governance of resilient infrastructures

Cities can be portrayed as complex and interdependent systems where dense interconnectivities and hybridities between social, natural and technological worlds are geographically concentrated. While these intricate interdependencies are mostly invisible in times of apparent stability, the disruption, destabilisation and immobilisation caused by crises dynamics reveal precarious interdependencies (Medd and Marvin, 2005: 44). Urban vulnerability may become visible through natural disasters, but that vulnerability is often shaped by the sensitivity and limited adaptive capacity of socio-technical systems, e.g. the breakdown of urban life due to the high-tech character and interconnectedness of energy, water and food supply or mobility (Bijker et al., 2014: 1). Resilience as ‘the capacity to bounce back’ from the disruption, destabilisation and immobilisation potential caused by external and internal threats has thus become the buzzword of policy and academic debates over the last decade. The concept has crossed disciplinary divides, but its understandings retain much of its ecological underpinnings. As a normative urban vision, it is highly attractive, as being resilient refers to various positive features of cities, i.e. their ‘capability to prepare for, respond to, and recover from significant multi-hazard threats with minimum damage to public safety and health, the economy, and security’ (Campanella, 2006: 141), as well as their creativity by learning from the experience and adapting to new circumstances with higher levels of functioning. The concept of resilience has become popular both in urban planning and urban studies, portraying cities as complex and interdependent systems and pointing to growing urban vulnerabilities. Much of the debate is concerned with definitions, principles, indicators and assessments, along with descriptions of tools of resilient urban planning, why they are important and which policies and tools should be formulated and adopted (e.g. Meerow et al., 2016; Parsons et al., 2016).

The application of resilience concepts to urban contexts has been roundly critiqued for its normative or even prescriptive orientation, for undertheorising its social dimensions, for omitting the social, political and cultural dynamics of communities (e.g. Brassett and Vaughan-Williams, 2015; Brown, 2014; MacKinnon and Derickson, 2012) and for focusing too narrowly on urban resilience to natural disasters or climate change. The merit of these policy and academic debates is, however, that they have put planning for disaster mitigation and preparedness, as well as for post-disaster reconstruction and recovery, on the urban agenda. Yet, they have contributed surprisingly little to the understanding of how urban vulnerability and resilience are mediated by infrastructures that must be designed to mitigate risks of cascading failures and to continue functioning under extreme hazard conditions. (Some of the few exceptions are Graham, 2010, Lakoff and Kinenberg, 2010 and Medd and Marvin, 2005.)

Mostly disconnected from the debate in urban studies, the resilience concept has also animated research on the architecture of technical infrastructures in order to mitigate a range of perceived risks from terrorism and other malicious acts to major accidents and natural hazards. In particular, the increasing complexity of technical infrastructures, which can exacerbate the consequences of natural or human-made disasters, has attracted much attention. Not only primary damages, but also the cascading effects of interacting physical, operational, financial and geographical dependencies and interdependencies of socio-technical systems, are seen as major challenges to comprehensive security management. More than single and uncoupled networks, interdependent networks behave in complex ways. For example, just a single failure, failures of a small fraction of elements or failures on a limited geographical scale can trigger accelerating and cascading dynamics, which may in turn have a catastrophic impact on the entire system as well as other systems coupled to it. Based on the pioneering study of Rinaldi et al. (2001), infrastructure scholars, mostly from the engineering sciences, have focused on the technical complexities of interdependent systems, and have developed diverse models to quantify, simulate and hierarchise infrastructure (inter)dependencies and couplings and the subsequent risks of cascading failures (for overviews, see Boyle and Speed, 2018; Kröger and Zio, 2011).

In the face of various external threats and risks of multi-infrastructural collapses, the interconnected, circulating flows across multiple infrastructure domains have become a priority in the academic and policy debates around securitisation. Beyond traditional approaches that try to prevent infrastructural failures and breakdowns from happening through higher standards of robustness, redundancy, reliability and flexibility, a growing body of research points to various political, cognitive, informational, cultural and resource barriers to a city being able to prevent ‘internally’ induced failures or to suppress deliberate acts of destruction. Instead, they call for technological cultures of ‘preparedness’ and resilience by promoting the capacity of infrastructure systems to anticipate and to prepare for extreme events, to absorb a disruptive event and continue functioning under extreme hazard conditions and to recover rapidly and learn from such events (e.g. Boin and McConnell, 2007; Chang et al., 2014). Various authors propose more ‘holistic’ or ‘integrated’ approaches to better anticipate and assess infrastructural vulnerabilities across interconnected urban systems, to set overarching urban policy priorities and to implement them in various domains (Boin and McConnell, 2007; Chang et al., 2014). Those multi-infrastructural approaches promote coordination and integration across sectoral boundaries; use joined-up management leading to a new form of administration or flexible, responsive and redundant engineering; and establish new dialogues between government, utility companies and the public regarding the extent and level of acceptable and cost-efficient resilience (for an overview, see Rogers et al., 2012).

While many of those proposed solutions might be relevant, the notion of resilience framed as a purposeful, collective and ongoing interaction and coordination between various (and often conflicting) actors and logics of different infrastructure domains, crisis management and user practices (for an overview, see Coaffee, 2013: 324) can be viewed as far more contingent, fragmented and contestable than is usually acknowledged (cf. Brassett and Vaughan-Williams, 2015). Yet, the governance of prevention of infrastructural failures and preparedness entails unusual complexities (Chang et al., 2014: 417): it must address multiple sources of disasters, multiple pathways for system failure, multiple and cascading interdependencies among a wide array of infrastructure systems and many potential alternative measures to reduce failure risk within and across systems (Chang et al., 2014). All of those complexities are extremely challenging for urban governance and policymaking.

First, the management of interdependencies and couplings across sectors translates into major coordination and cooperation problems in the context of the sector-orientated, fragmented and multilayered governance structures of urban infrastructure provision. The development of a governance of mitigation and preparedness implies the enrolment of a diverse assemblage of institutional actors operating horizontally and vertically in the public sectors, as well as NGOs and private companies. As Chang et al. (2014: 416f.) note, various ‘public and private sector organisations must be prepared, have up-to-date information, be connected by effective communication networks, and have experience in working together’. The question is how all these complexities can be addressed within an institutional environment, in which many of the infrastructure systems have been privatised and liberalised, and in which business interests and security concerns make information sharing and collaboration across sectors difficult.

Secondly, the governance of critical infrastructures generates considerable uncertainties. While adaptation and learning are central to concepts of resilience, only a few cities have direct experience with major disasters. Preventing or preparing for infrastructure failures thus means to plan for phenomena that, by their very nature, violate the very regular patterns of experience-based knowledge upon which planners usually rely (Boin and McConnell, 2007: 53): ‘Developing plans that work for the endless array of complex, chaotic and destructive scenarios that arise from interlocking and often mutually dependent infrastructures may be all but impossible’. Another challenge regarding information requirements pertains to security concerns and barriers to information sharing on liberalised and often fragmented markets (Chang et al., 2014: 419).

Thirdly, while urban stakeholders might generally agree on the overall goal of resilience, its translation into infrastructure investments and organisational readiness through staff training and crisis exercises can be expensive, time-consuming and highly controversial. The priorities of infrastructure providers include reducing physical damage to their own infrastructure system, minimising revenue losses and maintaining the organisation’s reputation, while they have few incentives to be concerned with the effects of own-system disruptions on other infrastructures (Chang et al., 2014). Investing resources to plan for a multitude of extreme events that are uncertain and may never happen or to provide for redundancies is decidedly controversial in a time of budget constraints, resource limitations and liberalised markets (Boin and McConnell, 2007: 53).

Institutional arrangements in the governance of critical infrastructures in Germany

In Germany, the protection of critical infrastructures has only emerged as a policy field since the late 1990s. Until that time, infrastructures were not an integral part of national and subnational security policies and crisis management. However, as a result of major infrastructure threats and failures (the Y2K problem, terrorist attacks on 9/11, several flood events and a power blackout in 2005), public perception has changed dramatically (Lauwe and Geier, 2016). In the 2000s, several national activities were initiated to protect critical infrastructures and to restructure national security architectures (Lange and Endreß, 2013). In 2004, the Federal Office of Civil Protection and Disaster Assistance was founded; one year later, the first recommendations for critical infrastructure protection were issued; an institutionalised form of cooperation between government and business regarding IT security was established in 2007 (called UP KRITIS); and a coordinating body between the federal government and the federal states was set up. An overall governmental strategy was published in 2009, prioritising voluntary cooperation of all relevant stakeholders from government, administration and companies for critical infrastructure protection (BMI, 2009).

Despite the increasing awareness of infrastructure vulnerabilities and national policy developments, the incumbent institutional set-up in crisis management has, however, mostly remained intact. In the German federal system, the responsibilities in the so-called Bevölkerungsschutz (equivalent to ‘civil protection’) are distributed between various levels of government (Pohlmann, 2015). While the national government holds key responsibilities for civil defense against military actions (Zivilschutz), a total of 16 Länder (federal states) share the responsibilities for security in peacetime as part of the so-called Katastrophenschutz (best translated as ‘crisis management’). The national government supports critical infrastructure protection with higher-level coordination activities and relevant training opportunities. According to the German constitution, the ministries of the interior of the Länder coordinate crisis management and are responsible for legislating the rescue service and the firefighting service. The Länder thus individually shape prevention and preparedness management in the infrastructure domains, and they differ considerably in their approach to leadership, coordination and cooperation (Petermann et al., 2011: 50). This institutional diversity is reinforced by the fact that the Länder delegate the key operational and organisational tasks in crisis management to city and county administrations. Moreover, several public-private organisations and NGOs have an active part in crisis management – many of them are largely based on local volunteers such as the Technische Hilfswerk (Technical Support Service), the local fire brigades and various medical emergency services.

Cities are thus major players in the coordination of civil protection and crisis management. It is foremost in the authority of the local crisis management to anticipate hazards, to develop mitigation and preparedness concepts and to manage crises. They have to establish security and crisis management programmes and ensure collaboration between utility companies, public administrations and various disaster management organisations (John-Koch and Fekete, 2011). Here, the governance of critical infrastructures has been added as a new responsibility of the local crisis management authorities since the 2000s. Consequently, their duties have widened to include complex technical and organisational tasks, while their institutional set-up and resources have rarely changed. Usually, the crisis management team is a unit of the respective municipal fire brigade with public servants who are predominantly trained in reactive modes of crisis management. Their staff has longstanding expertise and experience in developing risk analyses for fire, floods and hazardous materials, in constructing appropriate hazard control concepts and in managing related crises. Performing criticality and vulnerability analyses of multiple infrastructures, anticipating risks of cascading failures and managing infrastructural crises are new challenges rarely addressed in its staff vocational training. Accordingly, the technical know-how regarding infrastructure protection and resilience, the individual legal basis of different infrastructure domains, their markets, the diverse techniques employed locally, their cost structures and the specific terms of security are limited.

Challenges to the governance of critical infrastructures in German cities

While academic and policy debates have expounded the requirements and general challenges of urban infrastructure protection and resilience, the number of studies that have addressed how the postulated cross-sectoral governance of infrastructures plays out in practice is still small. It is thus the aim of the following sections to provide a first exploratory overview of the practices in German cities in coping with the complex governance challenges of urban and infrastructural resilience. Our qualitative analysis addresses the awareness of urban stakeholders and their key activities in preventing and preparing for infrastructural failures. More specifically, we critically assess how key urban stakeholders collaborate in urban risk and crisis management.

Our empirical research strategy was divided into three phases. First, we conducted interviews with employees of selected crisis management authorities of the Länder, the Federal Office of Civil Protection and Disaster Assistance, the German Association of Cities, the national coordinating body for all German fire brigades and the Association of Municipal Utility Companies to obtain a broad overview of the institutional arrangements and policies in local infrastructures governance. Secondly, we performed a nationwide telephone survey with experts from infrastructure companies and local crisis management teams in cities with 200,000–500,000 inhabitants. These district-free cities (kreisfreie Städte) have key authority in civil protection, and although they are equipped with specialised administrations, professional staff and technical know-how, it can be expected that problems in infrastructure governance are more prevalent in district-free cities than in Germany’s 14 large cities (> 500,000 inhabitants). Thirdly, we conducted in-depth studies with infrastructure companies and relevant departments of city administration and crisis management teams in four selected cities out of our entire sample of cities. Selection criteria included their location in different Länder (and thus their embeddedness in different regulatory frameworks), as well as the awareness of local decision-makers of infrastructure protection challenges and their willingness to provide in-depth information. Since the interviews dealt with sensitive issues including security-related information, interviewees’ commitment was strictly bound to consenting that all findings be anonymised without referring to the specific city. All interviews were structured according to key governance challenges expounded in the academic literature (see the second section), transcribed and the contents analysed and coded correspondingly. ²

Based on this empirical survey, the following sections indicate that the forms and achievements of coordination in these cities are highly heterogeneous. They clearly demonstrate that academic claims of an integrative risk management and coordinated pro-active crisis management for more resilient cities have hardly been implemented yet. The question then becomes why such initiatives have apparently not so far succeeded. As we illustrate below, our study indicates that the urban governance of critical infrastructures is an extremely challenging task since the following problems intertwine: 1) strong functional interdependencies in fragmented institutional environments; 2) uncertainty or limited knowledge; and 3) contestation.

Inter-organisational preparedness in fragmented governance structures

Mitigating and managing the risks of infrastructure interdependencies and couplings requires coordinated policies, overarching differentiated urban infrastructure domains and municipal boundaries. However, in the course of European regulatory market reforms, many networked infrastructures have been vertically unbundled into disintegrated companies (e.g. electricity generation, transmission, distribution and sales), and many public utilities have been privatised. Moreover, existing forms of horizontal integration in local multi-utilities have been restricted through regulatory requirements (e.g. interdiction of cross-subsidisation). As a result, even in municipally owned utility companies, there are today a number of independent and specialised subsidiary companies that manage individual subtasks. This unbundling within and between individual infrastructure domains leads to a large number of specialised organisations with intrinsic institutional logics, specialised knowledge and multiple interests. In all the cities under study, the restructuring of the utility markets resulted not only in a segmentation of the local infrastructure companies, but also in an unbundling of the utility companies’ formerly close interrelations with municipal governments. At the same time, stricter performance-related budget allocation, new public management concepts and private-public partnerships have been implemented in many municipalities.

These processes have led to diversified and highly complex institutional structures that undermine the ability to establish integrated risk and crisis management for cascading failures across different institutional and territorial boundaries in the different municipalities (see De Bruijne and Van Eeten, 2007). Approximately 80 percent of critical infrastructures in Germany are operated by private companies (BMI, 2011). According to the interviewees from the urban crisis management authorities, the domains which are especially shaped by dynamic markets, rapid technological change and institutional diversification are extremely difficult for local authorities to oversee. In particular, they assess that the electricity, information and communications sectors are uniquely critical: they provide basic services for both other infrastructures and for crisis communication and management. However, the authorities’ capability to anticipate and prepare for infrastructural vulnerabilities and to standardise processes in crisis management is limited, given the dynamic technological and market changes involved. As a result, the responsible contact persons in the utility companies are often not known to crisis management authorities:

‘We have different grid operators in our urban municipality and a variety of individual operators in the adjacent counties. But there is no list of these operators—we have to gather our information through our own Internet research’ (Employee, local crisis management authority, 2015).

‘An exchange between the infrastructure utilities and crisis management happens on a sporadic basis only, but a structured exchange does not exist’ (Managing director, electricity grid operator of the same city, 2015).

This is why urban vulnerabilities for cascading failures can rarely be assessed and managed. Or to sum it up in the words of Berthod et al. (2014: 396 f), our interviews indicate a ‘lack of inter-organizational preparedness’, and ‘there is little or no preparedness for cases necessitating cross-agency collaborations’.

However, the interviews with experts from utility industry associations and representatives of a national coordinating body for all German fire brigades point to the fact that the socio-technical interdependencies between infrastructure sectors often overarch municipal jurisdictions, but also localities in multiple ways. Urban decision-makers in risk management thus have to understand the ‘complex web of interconnectivities and new spatial interdependencies’ (Medd and Marvin, 2005: 46) and the potential ‘regional infrastructure disruption in disasters’ (Chang et al., 2014: 416). However, the territorial scope of local crisis management authorities does not reach beyond its municipal jurisdiction, and previous suppliers along the value chain (e.g. transmission network operators) and regional network operators (e.g. regional water suppliers, public transportation agencies or power grid operators) are beyond their authority. The same applies to the supply of critical goods from outside, such as drugs or surgical instruments, which depend on transportation and ICT infrastructures. Another example is urban transport systems, whose ICT-driven traffic control and information centres are partially located in other places. Function interruptions in the telecommunications and information technology sectors can be caused by blackouts in one place which add impairments in other places (as was reported in 2012 for the case of Frankfurt, where traffic control systems broke down due to a power blackout in Munich which affected Frankfurt’s control centre located in Munich).

Conversely, the spatial scope of electricity distribution grids and water networks demonstrates that the often publicly owned utilities frequently no longer operate exclusively within municipal boundaries. Their supply areas are thus not always congruent with administrative jurisdictions. Infrastructures operate at different scales and in multiple geographies, while prevention and preparedness policies are municipally organised. The complex geographies of the different infrastructures and the geography of cascading failures often conflict with incumbent territorial boundaries that have been put in place to govern conventional security threats and risks. This is even more so since the national governance of critical infrastructures mainly focuses on IT security, the Länder delegate the key operational tasks to the municipalities and local and regional resilience forums or similar coordinating institutions were never established in Germany.

Uncertainty and limited knowledge

Knowledge of internal and external threats is of central importance in order to mitigate cascading failures across different domains. How resilience is built into infrastructure systems depends to a large extent on the characteristics of different systems, whether they are closely or loosely coupled (Rogers et al., 2012: 82), and on the assessment of potential disturbances caused by natural hazards, targeted attacks and other factors. However, our urban case studies show that in this respect, enormous knowledge gaps complicate the mitigation and preparedness efforts of infrastructure stakeholders. Information exchange between the organisations involved happens at best through informal practices, while a knowledge exchange on potential vulnerabilities of individual domains or assets, local risk analysis across infrastructure systems and adequate strategies is hardly institutionalised.

The requirement of having to coordinate infrastructures in fragmented institutional arenas complicates a systematic exchange of information. Infrastructure planners operate in ‘siloed’ areas of expertise and may not have the necessary knowledge to assess interdependencies across sectors. The following statements are just two examples of the interviewees indicating that it is barely possible to anticipate and manage interdependencies systematically, given the distribution of sector-specific knowledge in different institutions. Both the crisis management staff as well as the responsible experts in infrastructure companies lack knowledge on the locations of the facilities of (other) infrastructures and their potential vulnerability or contribution to infrastructure resilience:

‘We as power suppliers do not know other facilities such as telecommunications or water supply and therefore cannot assess the interdependencies. This is the task of crisis management’ (Managing director, urban electricity grid operator, 2016),

‘The problem is that the actors do not know what others are capable of doing’ (Employee, local crisis management authority, 2016).

In the cities studied, the individual infrastructure operators each use different IT software. IT software programmes are, however, often incompatible with each other and require IT interfaces that do not exist in any of the cities. Consequently, during crises different assessments of the situation can develop among the individual stakeholders (Danielsson, 2016). Furthermore, the discussion about who in what situation needs what information, who can provide that information and in what form the exchange might be feasible is still in its infancy. First attempts to arrive at a solution usually fail – so the interviewees tell us – as a result of specific power interests at play and due to the considerable reluctance of local utility companies towards the public dissemination of business-related information. So far, knowledge of (reciprocal) vulnerabilities is fragmented or only exists at a narrow spatial scale, so that the localisation of critical system components at the city level is difficult to achieve.

In addition, the knowledge of the local crisis management staff regarding local utility restructuring is limited. Often, this coordinating authority is not informed about the reorganisation processes and new organisational responsibilities of units or companies. Conversely, however, difficulties for cooperation with governmental authorities also arise from businesses’ perspectives regarding security. National or international infrastructure companies (e.g. operators of transmission or telecommunications networks) are confronted with a diversity of local responsibilities, institutional settings, standards and forms of inter-organisational collaboration that are difficult to know in detail. In case of a large-scale crisis situation, they must thus cope with limited knowledge on local settings.

The study of another sphere of activity in infrastructure governance – preparing for external threats – also revealed fundamental knowledge gaps. Cities can rarely base their risk mitigation and management on past experience but rely on destructive scenarios of cascading failures. A challenge for politicians, crisis management and infrastructure companies on the road to resilience is to manage contingencies and uncertainties under complex conditions, to educate decision-makers in this regard and to align the governance of infrastructures thereto (see Welsh, 2014):

‘You have to gather everything by yourself, and each local authority has to think about how to create the appropriate concepts. This is a wasted resource. The federal level would need to standardise much more and set standards from above’. ‘We feel lost in planning for infrastructure failures. We started, and then new insights were obtained. This is extremely complex. We cannot do this considering our staff constraints’ (Employees, crisis management authorities in two different cities, 2016 and 2015).

In current practice, scenarios about possible threats, their likelihood, their impact and geographical scope are, however, shaped by the different perceptions of the participating local stakeholders. Within crisis management – as part of the state administration – contingency planning for critical infrastructures runs contrary to typical administrative logics based on experience, which impedes the preparation of concrete measures (see BBK, 2010: 37). So far, the existing scenarios (e.g. of local climate change) are perceived as too vague for motivating work at the city level, while interviewees lament a lack of best practice for security.

Contestation on financing and political prioritisation

As a result of liberalisation and privatisation policies, cost efficiency has become a guiding paradigm for urban utility companies. Investing in a higher level of infrastructure resilience is often unprofitable and thus considered unattractive. While interviewees report that about 20 years ago infrastructure companies had an independent budget for crises exercises, they point to today’s substantial pressures to economise over-capacities or redundancies:

‘In the past, the companies that had prepared and carried out [crises] exercises with us had specialised personnel. These jobs were cut’. ‘An assessment of interdependencies is enormously complex. A simple survey on gas stations in our city has already taken us four months. We can only look at individual sectors –a comprehensive concept is simply economically impossible’ (Employees, local crisis management authorities in two cities, 2015 and 2016).

The overall picture from the interviews shows that companies are more likely to accept temporary revenue losses through supply disruptions during crises than to invest in the prevention of such events, especially since they are not legally obliged to compensate customers for infrastructural outages. The unanimous opinion was that companies are not willing to invest in more than the statutory minimum level of security:

‘Companies only do what they are legally required to do. Services by private companies must be stipulated, otherwise nothing will happen’. ‘There must be money flowing. The companies argue only with profitability.’ ‘It’s all a question of profitability. If nothing happens for a long time, nobody is interested in security aspects’ (Employees, crisis management authorities in three cities, 2015 and 2016).

The interviews reveal in particular a startling setting with city power grid operators: although electricity is fundamental to the functioning of most other infrastructures and to crisis management, the grid operators do not perceive other utilities in the city (such as hospitals or waterworks) as critical infrastructures, but rather as customers like anyone else with their own responsibility for back-up capacity. Grid operators thus rarely prioritise emergency or recovery services.

In contrast, other experts from utility companies point to legal restrictions. They suggest that regulatory authorities such as the Federal Network Agency (supervising grid fees and non-discriminatory network access in telecommunication, electricity and railways) and the cartel authorities of the Länder (antitrust authorities responsible for water supply, sewerage and waste) would prevent investments in higher reliability and preparedness with a reference to customer-orientated cost. Likewise, the control of grid fees, which is based on standard investments and the operational costs of networks, is aligned with traditional sectors and thus prevents inter-sectoral security efforts. Moreover, financial (re)distribution struggles within municipalities are an everyday phenomenon. Ever since the introduction of double-entry bookkeeping in the years 2009–2013, security investments for infrastructure have often needed to be taken out of other budgets. Overall, new or changing inter-sectoral interfaces remain little noticed, due to their unresolved financing issues and insufficient economic potential.

In contrast to the timeliness of critical infrastructure protection and resilience in academic debates, our studies suggest that urban resilience as a concept of disaster prevention has only sporadically been established. Rather, urban decision-makers are often not aware of infrastructural risks or an impending need for action, or simply give their management a low priority. Our case studies show that awareness of potential risks is more pronounced in cities that have witnessed disruptive events in the recent past. Interviewees from a city that has been repeatedly confronted with floods report that they added four additional employees in the office of crisis management to be better prepared for future events. Although the activities are primarily focused on flood events, the overall awareness of disasters and urban vulnerability has consequently risen on the crest of disruptions. In particular, politicians are now more strongly blamed for shortcomings in civil protection. However, the majority of cities in our sample have no relevant experience with major natural hazards or crises invoked by technical failure, terrorism or sabotage. As a result, political leaders give scant attention to mitigation and preparedness for infrastructural breakdowns. Company interviewees perceive that local crisis mitigation and preparedness are hardly sufficient. Without public guidance on risk tolerance, desired levels of critical infrastructure protection and procedural norms in risk management, the interviewees in utility companies claimed to be limited in their scope for action:

‘What failure is acceptable? What protection level do we want to achieve […] and what efforts do we need to make? We cannot decide this as a company. This is a political task. They must tell us what level of protection we want to achieve and then it is also good. You can always invest more. So, the final product must be defined’ (Managing director, urban electricity grid operator, 2015).

Discussion

Although we can indicate a growing awareness on the part of local decision-makers, our empirical study indicates that this has not yet resulted in the development and institutionalisation of systematic hazard, risk and interdependence analyses, respective disaster management plans or the setup of a coordinating force across the institutional boundaries of the administrations and utility companies involved. Indeed, decision-makers describe the governance of urban mitigation of potential infrastructure failures and the preparedness for them as a challenge whose attributes conform with a ‘wicked problem’ (Carayannopoulos and McConnell, 2018; Rittel and Webber, 1973) – a highly complex problem that is extraordinarily difficult to resolve, as it is characterised by considerable uncertainties, as well as coordination problems and conflicts between government departments and multiple private and public sectors.

First, managing infrastructure risks cuts across multiple institutional agendas in government departments, NGOs and utility companies. Contrary to requests for cultures of interorganisational preparedness, individual service providers focus at best on the vulnerability of their own system, while urban concepts for integrated emergency management are almost completely absent. Relevant government departments are often not aware that they (and not the crisis management authorities alone) have major responsibility for these tasks. Moreover, rapid technological change, neoliberal market reforms and institutional unbundling result in the institutional diversification of utility domains which are thus extremely difficult for local authorities to oversee and coordinate. Apart from the challenges of coordinating fragmented utility domains, the spatial scope of effective critical infrastructure protection and resilience exceeds urban jurisdictions. Regional cooperation that addresses the multiple geographies of infrastructures has, however, not yet been established.

Secondly, our study points to considerable uncertainties as to how urban resilience could and should be achieved. Important organisational changes in the urban utility sectors are often not communicated to crisis management staff, whose plans thus rely on incomplete or false assumptions and outdated information for contact persons in the companies. Moreover, information on best practices or guidelines, the scenarios at hand and the policies are – if existent at all – too vague for motivating urban stakeholders to concrete action.

Thirdly, there are high levels of contestation over both the nature of the problem and potential solutions, and the preparedness for infrastructural crises is often seen as the responsibility of the crisis management alone. Particularly, the funding of mitigation and preparedness measures is highly controversial, and the detection of, and preparation for, multi-infrastructural disruptions are often of low priority for local utility companies and policy-makers.

As a consequence of unresolved and ‘wicked’ governance challenges, we can identify three main coping practices of local stakeholders.

First, the development of cities resilient to infrastructure failures can best be described as currently being in a state of ‘local experimentation’: in the cities we assessed, individual stakeholders are creatively preparing for infrastructural failures by ‘experimental’ and incremental approaches. It seems as if each city has to ‘reinvent the wheel individually’ (employee of local crisis management authority, 2016), while an inter-municipal exchange of experience and agenda-setting both in a regional context and at a national level (e.g. through inter-municipal or utility associations) is largely missing. These local initiatives are well-intentioned and important to develop, test and refine innovations in crisis management. However, deliberate policy processes are mostly missing – processes that could systematically assess infrastructural criticalities and vulnerabilities within and across cities, define common goals in urban crisis mitigation and management, reshuffle the siloed and territorial orientations and practices in different infrastructure domains and help rethink the institutional basis for crisis mitigation and management.

Secondly, crisis experiences shape urban vulnerability and resilience thinking. When we compare our case studies, we can observe how the scope and temporal distance of concrete urban crises largely shape two types of urban practices in risk management. Cities that have witnessed major disruptive events tend to focus their plans, guidelines, checklists and related tasks in preventing or preparing for disruptions more selectively on this type of crisis, while potential other hazards are neglected. In cities without such experiences, the projects, planning and coordination initiatives usually anticipate a larger variety of possible disruptions. However, the political attention to and prioritisation of crisis management are lower, leading to limited human and financial resources in crisis management to facilitate resilience.

Thirdly, while urban stakeholders acknowledge the vulnerability of urban infrastructures and the need for ‘interdependency management’ between them, the unprecedentedly complex tasks of urban infrastructure governance exceed the problem-solving capacities of individual stakeholders. That is why they tend to focus on incremental amendments within their own jurisdiction and area of responsibility (interdependency paradox). Urban crisis managers, utility companies and administrations are faced with diverging trends – the increased functional interdependency of infrastructures, and the institutional fragmentation of the organisations that operate them. On the one hand, risks migrate across infrastructure domains and territories, and as they do, they require risk analyses and management to cross organisational and territorial boundaries (Almklov et al., 2012: 224). On the other hand, the unbundling of infrastructures and the differentiation of various independent subdomains operating in specialised markets and at different geographies complicate information exchange, collaboration and the management of infrastructure interdependencies. Increased competitive pressure leads to a narrow focus on core tasks and knowledge deficits about interdependencies with other domains. Moreover, the responsible organisations for coordinating risk analysis and management, the local crisis management authorities, often do not have the necessary infrastructural know-how and qualified staff to facilitate infrastructural resilience. They thus multiply the uncertainties that are intrinsic to risk prevention, management strategies and contingency planning. Due to the limited political attention to questions of infrastructure resilience and protection, important political roadmaps are still missing. In this light and due to the large number of stakeholders and interests involved, it is not surprising that infrastructure companies are reluctant to collaborate and share sensitive information.

Conclusion

In our article, we have introduced the call for cultures of resilience by recent academic and policy debate on the governance of critical infrastructures. In contrast to early approaches in critical infrastructure protection, the resilience approach assumes that not all infrastructure failures can be completely avoided. Cities must therefore prepare for disturbances in order to mitigate their urban impacts, to manage them, to recover quickly and to learn from them. As a key indicator for resilient cities and infrastructures, academic and policy debates refer to the deliberate management of infrastructural interdependencies and the building of cross-organisational partnerships between government, business, security agencies and civil society – thus the joint preparedness of a broad array of public and private actors (Boin and McConnell, 2007: 54). We have contrasted this debate with practices of cross-sectoral coordination in German cities, pointing to the ‘wicked’ character of more integrated infrastructure governance. Here, we could identify innovative urban practices and policy initiatives in the governance of critical infrastructures, which have proven effective in local crisis events, e.g. ad hoc working groups of utility companies, crisis management authorities and other relevant infrastructure stakeholders, management plans for power outage scenarios or extensive crisis management manuals. However, incumbent risk management regimes have rarely adapted to the new challenges of infrastructure resilience. Whilst the concept of resilience has shaped policy and academic debates, we have pointed to considerable implementations gaps in how such ideas are operationalised in practice.

What Hajer (2003: 175) terms an ‘institutional void’ thus characterises the urban governance of critical infrastructures: a lack of generally accepted rules, accepted knowledge, procedural norms and organisational capacities according to which urban policymaking and urban politics in the mitigation of and preparedness for infrastructural crises is to be conducted. This should, of course, not be misunderstood as an institutional ‘emptiness’ within individual utility industries or policy fields. It is rather the interference zones within and between ‘siloed’ infrastructure domains that are shaped by a lack of generally accepted rules, knowledge and procedural norms that could guide the governance of socio-technical interdependencies, interfaces and the risks of cascading infrastructure failures. This applies, first of all, to the local crisis management staff, who have major responsibilities in infrastructure protection and resilience but lack adequate institutional, human and financial resources, the knowledge to carry out cross-sectoral infrastructural tasks and the ability to coordinate the interlacing of networks built and controlled by others. To overcome roadblocks to increased infrastructural resilience and risk mitigation, several lessons can be drawn that need to be addressed by further research and policy-making.

First, creating and perpetuating a sense of potential risks of cascading infrastructure failures and of the resulting urban crises among local decision-makers holds potential for addressing the problems in infrastructure governance and for undercutting tendencies towards incremental responses of local stakeholders arguing with limitations in jurisdiction, evidence and political/financial support (Carayannopoulos and McConnell, 2018). Secondly, the allocation of sufficient financial resources, planning authority and qualified staff to crisis management authorities as well as professional training programmes for local public and civil crisis managers are key to build-up sufficient institutional resources and expertise and to establish a sustainable coalition for local support. Thirdly, the initiation of strategic planning processes could mitigate existing problems. Such planning processes could involve a spatial assessment of infrastructure interdependencies and vulnerabilities including the identification of the most vulnerable areas and assets, the definition of protection levels and of short- and long-term goals, the balancing between risk mitigation and resilience and the definition of key responsibilities of different stakeholder groups and residents. Moreover, an exchange of experiences and ‘best practices’ between local authorities but also a strong engagement of utility companies with crisis management need to be consolidated.

However, capacities for resilience cannot be enhanced solely at the municipal level. Equally important are national and European regulations that reflect more adequately on the ‘wicked’ problems of urban infrastructure governance. This includes the re-assessment of neoliberal market reforms such as the unbundling and privatisation policies by considering their impacts on institutional diversification and fragmentation and their trade-offs with coordinated crisis management. Moreover, the national promotion and funding of local experimentation and innovative pilot projects for infrastructure protection and resilience could help innovate existing municipal practices and inter-municipal learning. Finally, the scope for action and the new responsibilities of the local crisis management authorities need to be legally specified so that they can (and have to) fulfil a proactive and leading role in the mitigation of and preparedness for infrastructural risks. Since urban and infrastructural vulnerabilities strongly depend on spatial and socio-technical contexts, the applicability of universal security/resilience standards and regulations is limited. An adoption of unitary procedural standards in local risk assessment, contingency planning and crisis management within and across individual infrastructure domains could, however, force municipalities to address infrastructural vulnerabilities and develop the necessarily place-based solutions to urban and infrastructural vulnerabilities and it could help to harmonise the local governance of infrastructures. Moreover, such procedural standards could help to operationalise national infrastructure protection strategies and their vague claim of voluntary cooperation among governments, businesses and civil society.