Transportation System Resilience: Research Roadmap and White Papers (2021)

Below is the uncorrected machine-read text of this chapter, intended to provide our own search engines and external engines with highly rich, chapter-representative searchable text of each book. Because it is UNCORRECTED material, please consider the following text as a useful but insufficient proxy for the authoritative book pages.

White Papers: Understanding Transportation Resilience P A R T   2

24 Initially presented at industry meetings during the research for this project, the three papers that make up Part 2 of this report were further developed to function as discussion tools for use by transportation agency executives and policy makers engaging with peers and elected or appointed officials. The three papers address topics that were selected by the NCHRP 20-59(54) project panel from a list of 11 resilience-related issues: (1) cybersystems resilience, (2) economics, (3) sea-level rise/extreme weather, (4) earthquakes, (5) chokepoints/single points of failure, (6) human factors/ continuity of operations (COOP), (7) information for decisions, (8) automated/connected vehicles, (9) workforce development, (10) drought/heat, and (11) community. References for the papers appear under “Part 2” in the report’s “References” section. The questions presented in the discussion papers are neither exhaustive nor representative of all agencies. It is expected that agencies will modify them to suit local priorities and circum- stances. Similarly, the contents of the discussion papers do not, of themselves, constitute how-to guides or a roadmap for change. Rather, each paper is meant to help shape the topics and plot a short-term forward course. The papers do not provide a lengthy presentation of what resil- ience is or how it is defined, as this topic has already been covered in AASHTO’s Understanding Transportation Resilience: A 2016–2018 Roadmap for Security, Emergency Management, and Infrastructure Protection in Transportation Resilience (Fletcher and Ekern 2017). Readers are encouraged to review all three sections in Part 2 in conjunction with the 2017 AASHTO report and the contractor’s final report that provided the basis for the AASHTO publication (see Refer- ences). Key contents of the three sections are: Understanding Transportation Resilience: An Environmental Perspective 25 Essential Points 26 Introduction 28 Weird Weather: The New Normal 32 Weather Trends Summary for Transportation Policy Makers 33 The Importance of Environmental Resilience 33 A Resilience Management Approach to Environmental Hazards 35 Understanding Regional Differences 37 Environmental Resilience Summary for Transportation Policy Makers 38 Engaging Environmental Resilience Understanding Transportation Resilience: An Economic Perspective 39 Essential Points 40 Introduction 40 The Main Thing: A Matter of Priorities 42 An Economics Perspective of Transportation Resilience 46 Building Resilient Asset Management 47 The Business Case for Resilience 47 Engaging Economic Resilience Understanding Transportation Resilience: A Cyber Perspective 49 Essential Points 50 What Is Past Is Prologue 51 Critical Cyber Trends for Transportation Policy Makers 55 Cybersecurity or Cyber Resilience? 56 Faces of Cyber Resilience 56 Actions That Improve Cyber Resilience 59 Engaging with Cyber Resilience 59 A Scenario: Test for Cyber Resilience Readiness

25   This section of NCHRP Research Report 975 has been written for transportation policy makers and executives to provide a mechanism by which they can engage their peers together with elected and appointed officials who may be unfamiliar with the conversation surrounding trans- portation resilience. The contents of this section address three critical questions: 1. What is the environmental perspective of transportation resilience? 2. Why is this issue critical or important to my agency and me? 3. What do you want me to do about it? Of necessity, the treatment of these questions is both broad and brief. Detailed guidance is contained in NCHRP Research Report 976: Resilience Primer for Transportation Executives (Matherly et al. 2021), which was developed under NCHRP Project 20-59(55), and in additional material developed by the NCHRP, the FHWA, and others. The discussion takes as a scientific baseline the reports produced by the U.N. Intergovern- mental Panel on Climate Change (IPCC), the international body responsible for assessing the science related to climate change; the U.S. Global Change Research Program, a consortium of 13 federal agencies; and the U.S. National Academies of Sciences, Engineering, and Medicine. The report does not evaluate the science presented in those reports. Essential Points • Transportation infrastructure resilience refers to the ability of the transportation system to recover from or adapt to significant disruptive events. One benchmark of a resilient system is to have a formal integrated investment and operational management strategy designed to maintain or restore functionality that would otherwise be compromised. • Resilience management has short-term (hours to months), intermediate (years to decades), and long-range (decades and longer) dimensions that roughly correspond to operations, engineering, and planning responsibilities. These dimensions are dynamic and interrelated. • Resilience management leverages pre-existing risk management frameworks, although resil- ience and risk are not the same things. Resilience-enhancing recommendations are reflected in updated emergency operations plans, revisions to engineering standards, and in statewide and metropolitan transportation planning processes. • The transportation infrastructure sector is vulnerable to a wide range of environmental (i.e., meteorological, climatic, geologic, and cosmic) hazards (see text box). No region or mode of transportation is immune, although specific risks vary greatly by agency, location, and mode. Understanding Transportation Resilience: An Environmental Perspective

26 Transportation System Resilience: Research Roadmap and White Papers • Many of these hazards are related to the earth’s climate, resulting in increasingly severe or unusual weather as the “new normal.” The greatest climate-related risks to transportation are extreme heat, heavy downpours, and rising sea levels, all of which are projected to increase in the coming decades. • Environmental disasters resulting from these phenomena reduce system reliability and performance, drive up user costs, accelerate deterioration, and increase total infrastructure life-cycle costs. • Additionally, weather-related disruptions or loss of services, particu- larly when viewed as preventable, erode public trust, impact local and regional economies, and generate significant criticism from elected officials, the media, and the traveling public. • During the 20th century, policy promised that the nation would do whatever necessary to repair and restore damaged infrastruc- ture using a combination of federal, state, and local resources. The 21st-century reality is that the severity and frequency of extreme events are increasing, and many communities can no longer rely on outside resources to be made whole. • A national, “one-size-fits-all” resilience strategy is neither desirable nor achievable. The emerging, resource-rich, urban “megaregions” enjoy many more resilience options than do “underperforming,” mostly rural, regions. This gap between the “haves” and the “have-nots” is projected to widen over the next century. • Although the need for a more-effective set of short- and long-term resilience strategies is increasingly obvious and urgent, many political, institutional, scientific, and technical barriers exist. Finding creative ways to overcome these barriers is a critical challenge for transportation leadership. • DOTs cannot go it alone. Although the DOT may be the designated lead agency for transpor- tation infrastructure, collaborative and cooperative community-based initiatives are crucial. Introduction Jupiter, Zeus, Thor, Ba’al, Indra, Perun, Tlaloc. Throughout history and across many cul- tures, human beings have personified and named extreme weather phenomena. Primitive peoples justifiably felt at the mercy of forces they couldn’t predict, appease, or control, and which they experienced as powerful, irascible, capricious, and destructive entities. The prudent person hunkered down, waited out the storm, and when the skies cleared, picked up the pieces and carried on. Perhaps unsurprisingly, this basic strategy has survived intact to the present. The Dragon Kings of Chinese mythology may have been replaced by storms with names like Katrina, Irene, Sandy, and their “siblings,” but the default strategy for environmental disaster resilience can be summarized as “since extreme events occur so infrequently in random places, wait until something really bad happens and then do whatever it takes to restore things to their previous condition using whatever resources are necessary.” It’s not a bad plan—except that extraordinary events are now becoming ordinary. Heavy storms are becoming more frequent and in many cases, more severe. Deadly heatwaves are occurring in places that have never before experienced triple-digit temperatures. Affected places no longer look quite as random as they once did, and the costs for post-disaster repair or recon- struction are beginning to challenge even the federal government’s ability to provide emergency relief. Entire communities have been abandoned as the costs to restore public infrastructure and private property far exceed their economic value. Environmental Hazards Challenging Transportation Resilience • Heavy Rainfall and Runoff • Heavy Snow and Ice Storms • Flooding and Storm Surges • High Winds and Tornados • Hurricanes and Cyclones • Extreme Heat and Heatwaves • Extreme Cold • Drought • Wildfires • Lightning • Rock Falls and Landslides • Avalanches and Mudslides • Earthquakes and Tsunamis • Sinkholes • Volcanoes and Lava Flows • Space Weather and Solar Storms • Sea-Level Rise and High Tides • Groundwater

Understanding Transportation Resilience: An Environmental Perspective 27   This “new normal” is creating an inconvenient reality for all DOTs and their senior leader- ship. Although they have been dealing with the triple challenges of increasing financial pres- sures, accelerated project delivery expectations, and a changing workforce while providing effective programs that are responsive to the communities they serve, these agencies now must alter their operational priorities to deal with evolving environmental and climatic change. Con- sequently, DOTs across the nation now have to manage transitions to different ways of thinking about innovative approaches to providing services. Public-sector transportation agencies are no longer solely focused on building the nation’s infrastructure, as they have been for nearly 100 years. Their already complex mission—focused on mobility, accessibility, safety, and environmental stewardship—is now driven by additional demands for security, reliability, and resilience. Resilience, defined as the ability to recover from or adapt to significant disruptive events, has many faces (see Figure 2-1). It affects the full range of traditional transportation functions (e.g., planning, engineering, maintenance, and operations spanning all modes of transporta- tion) and is a central issue within other, interdependent and critical infrastructure sectors such as communications, emergency services, energy, government services, and IT. Planning for, provisioning, and operating a resilient transportation system encompasses time horizons that begin today and look 50 years into the future and beyond. The challenge associated with implementing strategies for resiliency arises from the scope, scale, and complexity of system resilience and related topics. A quick scan of the range of environmental hazards potentially affecting transportation system functionality reveals a daunting array of meteorological, climatic, geologic, and even cosmic events. Although each of these risks needs to be carefully planned for, mitigated, and managed, this discussion will not be able to cover each hazard separately. An informal survey of DOT emergency managers across the nation indicated that the two types of hazards of most interest and concern related to “too much heat and too much water.” This impression was Source: Fletcher and Ekern (2017) Figure 2-1. Faces of resilience.

28 Transportation System Resilience: Research Roadmap and White Papers reinforced during the NCHRP project team’s review of the research literature. Consequently, this discussion paper focuses on extreme temperatures, severe storms, and sea-level rise. To advance the understanding of extreme weather and rising sea-level impacts and their effects on state DOTs as they move into the 21st century, the journey begins by understanding climate and weather trends across the United States. Weird Weather: The New Normal In response to the Global Change Research Act of 1990, the U.S. Global Change Research Program in partnership with the National Academy of Sciences and the Federal Committee on Environment, Natural Resources, and Sustainability, supported by over 300 technical experts, published Climate Change Impacts in the United States: The Third National Climate Assessment (Melillo et al. 2014). This 2014 document is intended to assist decision making at all levels by providing a national summary of the most recent climate change science. The report also projects climate-related trends and impacts from 2014 throughout the rest of the coming century. U.S. Climate Trends Over the past several decades, several notable changes to the nation’s climate have occurred (see text box). Heatwaves have become more frequent, had longer durations, and involved Climate Change Impacts on Infrastructure Global climate is changing and this is apparent across the United States in a wide range of observations. Some extreme weather and climate events have increased in recent decades, and new and stronger evidence confirms that some of these increases are related to human activities. Impacts related to climate change are already evident in many sectors and are expected to become increasingly disruptive across the nation throughout this century and beyond. Infrastructure is being damaged by sea level rise, heavy downpours, and extreme heat; damages are projected to increase with continued climate change. Sea level rise, storm surge, and heavy downpours, in combination with the pattern of continued development in coastal areas, are increasing damage to U.S. infrastructure including roads, buildings, and industrial facilities, and are also increasing risks to ports and coastal military installations. Extreme heat is damaging transportation infrastructure such as roads, rail lines, and airport runways. Planning for adaptation (to address and prepare for impacts) and mitigation (to reduce future climate change, for example by cutting emissions) is becoming more widespread, but current implementation efforts are insufficient to avoid increasingly negative social, environmental, and economic consequences. Source: Melillo et al. (2014)

Understanding Transportation Resilience: An Environmental Perspective 29   higher temperatures, whereas cold spells have abated. Droughts and heatwaves are projected to become more severe, particularly in the Southwest. Winter storms have increased in frequency and intensity, and their tracks have shifted northward. Meanwhile, the intensity, frequency, and duration of North Atlantic hurricanes have increased. Temperature Trends In the United States, the average temperature has increased by 1.3°F to 1.9°F since record-keeping began in 1895; and most of this increase has occurred since about 1970 (see Figure 2-2). The most recent decade was the nation’s warmest on record. The current decade looks to be even warmer. Although temperature rise is not uniform across the country or over time, it is expected to continue. Rising temperatures across the United States have reduced lake ice, sea ice, glaciers, and seasonal snow cover over the past few decades. The length of the frost-free season (and the growing season) has been increasing since the 1980s as plant hardiness zones continue to shift northward (see Figure 2-3). During the period Source: Melillo et al. (2014) Figure 2-2. Temperature change, 1991–2012, compared to 1901–1960 average.

30 Transportation System Resilience: Research Roadmap and White Papers from 1991–2011, the average frost-free season was about 10 days longer than during the period from 1901–1960. At the same time, ice and snowmelt have been occurring earlier in the spring, resulting in more flooding and affecting watershed ecosystems and agriculture. Rainfall and Snowfall Trends Average annual rainfall in the United States has increased—an effect in part attributable to the warmer atmosphere holding more moisture—although some areas have seen reduced pre- cipitation (see Figure 2-4). More winter and spring rainfall is projected for the northern United States and less for the Southwest. Across most of the United States, the heaviest rainfall events have become heavier and more frequent. The amount of rain falling on the heaviest rain days has also increased over the past few decades. Increases in the frequency and intensity of heavy downpours are projected across the entire country (Figure 2-5). Sea-Level Rise Sea-level rise is caused by a combination of thermal expansion of the oceans (caused by increased atmospheric heat due to climate change) and the melting of glaciers and the great ice sheets of Greenland and Antarctica. New data show that the recent increase of global mean sea level (GMSL) of approximately 8 inches has been much greater than at any time in at least the past 2,000 years. Since 1992, the rate of GMSL rise has been roughly twice the rate observed over the last century, providing evidence of additional acceleration. The 2014 IPCC Summary for Policy Makers projects that GMSL rise will continue during the 21st century, very likely at a faster rate than that observed from 1971–2010 (IPCC 2014). Although projected rates and amounts vary, a January 2017 report by the National Oceanic and Atmospheric Administration (NOAA) suggests that a rise of GMSL in the range of 1 foot–8 feet (0.3 meters–2.5 meters) is possible within the coming century (NOAA 2017). Source: Melillo et al. (2014) Figure 2-3. Observed increase in length of frost-free season.

Understanding Transportation Resilience: An Environmental Perspective 31   Source: Melillo et al. (2014) Figure 2-5. Change in very heavy precipitation, 1958–2012. Source: Melillo et al. (2014) Figure 2-4. Precipitation change, 1991–2012.

32 Transportation System Resilience: Research Roadmap and White Papers Sea-level rise differs from extreme weather in at least two essential ways: First, it is a coastal phenomenon of primary interest to only half of the states. Second, unlike the brief periods asso- ciated with extreme heat or rainfall, creeping sea levels are slow, continuous, and inexorable. Weather Trends Summary for Transportation Policy Makers The impacts from extreme weather events and rising temperatures are affecting the reliability of the U.S. transportation system in many ways. Extreme weather disasters are considered “lumpy”—that is, they are unpredictable in type, location, frequency, and impact. Nonetheless, they currently disrupt transportation services in all areas of the country, negatively affecting system operators and users alike, and projections indicate that such disruptions will increase. By definition, this situation increases the overall risk to the system. Sea-level rise (and rising coastal groundwater levels), coupled with tidal movements and storm surges, will continue to increase the risk of major coastal impacts on transportation infra- structure, including both temporary and permanent flooding of airports, ports and harbors, roads, rail lines, tunnels, and bridges (Figure 2-6). Extreme weather and sea-level rise are factors that accelerate infrastructure repair and replace- ment cycles and reduce overall system reliability and performance while driving up investment and operating costs. This situation affects all modes in all regions of the United States. In addition to short-term extreme weather events, long-term climatological trends are resulting in a “new normal” climate regime affecting all aspects of transportation. This new Source: Melillo et al. (2014) Figure 2-6. Airports with at least one runway vulnerable to storm surge at the depicted elevation.

Understanding Transportation Resilience: An Environmental Perspective 33   normal weather is increasing, and will continue to increase, the total cost of the nation’s trans- portation systems to the taxpayer and the system users. The downward spiral of increased risk, diminished reliability, and lower performance, driven by an increasingly chaotic environment and constrained by limited disaster relief funding, requires immediate and thoughtful adoption of resilience management practices by every trans- portation infrastructure owner. The Importance of Environmental Resilience Over centuries of practice, engineers have learned to accommodate an unpredictable environ- ment by relying on historical norms to set reliable, long-lasting benchmarks for their design and construction standards. Unfortunately, this approach is being overtaken by events, and even current planning and design assumptions may no longer be adequately addressed by existing standards. The 100-year storm is now occurring once a decade in some locations; bridges are being overtopped by storm surges at high tide for the first time. A gradually warming climate is accel- erating asphalt deterioration, and heatwaves are causing buckling of pavements and rail lines and endangering construction and maintenance personnel working outdoors. Extreme tem- peratures are also placing significant demands on the power/energy grids, which may impact the transportation infrastructure, particularly if significant parts of the interconnected grid go down. Stream flows based on increasingly frequent and intense rainfall instead of slower snow- melt increase the likelihood of bridge damage from faster flowing streams. Less snow in some areas is reducing snow removal costs and extending construction seasons while other DOTs are depleting their winter maintenance budgets weeks before the end of the season. The examples are real, compelling, and—along with other climate changes—occur in every state. In the direst of cases, some coastal ports and airports are projected to be underwater within the planning horizons of their operating authorities. Clearly, highways, rail connections, and other low-lying infrastructure associated with these facilities also are threatened. In addition to these direct impacts on system assets, our society has come to expect a safe, secure, and reliable transportation system. Significant loss of service, particularly when viewed as preventable, erodes public trust, impacts local and regional economies, and generates sig- nificant criticism from elected officials, the media, and the traveling public. A Resilience Management Approach to Environmental Hazards What can a state DOT executive do now or worry about when it comes to creating resiliency against extreme weather and/or sea-level rise, and how does that DOT harness and augment its resources to sustain operations and protect its assets in the face of impacts from changes in weather? The framework presented in Table 2-1 is adapted from the 2006 National Infrastructure Pro- tection Plan (NIPP) Risk Management Framework, which calls on each infrastructure sector to identify those functions, assets, networks, systems, and people (FANSP) that make up the nation’s critical infrastructure and its key resources. Table 2-1 and Table 2-2 present the FANSP framework and environmental impacts on the resilience framework as these concepts were further developed in the May 2007 Critical Infrastructure Plan (DHS 2007).

34 Transportation System Resilience: Research Roadmap and White Papers Severe Storms (Heavy Rainfall, Runoff, Flooding, Heavy Snow, Ice) Extreme Heat Heat Waves Sea Level Rise (Storm Surge, High Tides) Functions Safety, Traffic Impact; Construction Project delay; Debris, Evacuations, Operations uncertainty Safety, Traffic Impact; Construction Project delay Increased MOT Assets Accelerated loss of performance; Temporary or permanent loss of asset; Damage; Accelerated replacement and maintenance costs Accelerated loss of performance; Temporary or permanent loss of asset Damage; Accelerated replacement and maintenance costs Accelerated loss of Performance; Temporary or permanent loss of asset; Damage; Accelerated replacement and maintenance costs Networks Enhanced Cooperation/Coordination COOP/COG Activation EMAC Activation Enhanced Cooperation/Coordination COOP/COG Activation EMAC Activation Enhanced Cooperation/Coordination Systems Loss of availability Loss of integrity Loss of availability Loss of integrity Loss of availability Loss of integrity People Environmental Illness Emotional Trauma Injury Environmental Illness Emotional Trauma Psychological Stress Relocation Externalities Increased delay/detour time, length, user cost; Environmental degradation; Loss of business income; Ancillary damage cost, Public perception Increased GHG emissions Environmental degradation; Loss of business income, Abandonment and migration EMAC = Emergency Management Assistance Compact; GHG = greenhouse gas; MOT = maintenance of traffic. Source: DHS (2007) Table 2-2. Environmental impacts on the resilience framework. FUNCTIONS The business processes, workflows, job assignments, tasks, and positions in a state DOT that are critical to the performance of continued transportation service through any hazard or disruption ASSETS The infrastructure, equipment, resources, tools, vehicles, hardware, roadways, bridges, tunnels, and other facilities owned and operated by a state DOT or other authority that ensure the continued safe transport of goods and people through any hazard or disruption NETWORKS The relationships maintained by a state DOT with local municipalities, contractors, the private sector, and other branches of local, tribal, state, and federal government to ensure the continuity of transportation operations through any hazard or disruption SYSTEMS The critical information technology platforms, applications, and networks, including all electronic forms of data, used by state DOT personnel to operate its assets and infrastructure, support functional continuity, and enable network communication and reliability through any hazard or disruption PEOPLE The necessary personnel needed by a state DOT to ensure that transportation services are provided through any hazard or disruption Source: DHS (2007) Table 2-1. FANSP resilience management framework.

Understanding Transportation Resilience: An Environmental Perspective 35   Each framework element depends on every other to perform adequately; all must perform for the system to operate. The framework is operationalized by developing a series of interrelated architectures using the unique items and inventories controlled by a specific DOT. In most DOTs, the resilience framework is based on and incorporated into their existing asset manage- ment, performance management, risk management, and information resource management programs. Once the resilience architecture is in place, its components can be assessed for their level of resilience (i.e., redundancy, backup, substitution,) and their need for modification or adaptation. Results of the resilience assessment can be reflected in emergency operations plans, engineering and construction standards revisions, and statewide and metropolitan long-range transportation plans. Each distinct event challenges the system differently. In addition to the primary (generic) impacts on individual elements as shown in Table 2-2, there are indirect and synergistic con- sequences to be considered. For example, a possible “hidden” impact related to “People” might be the loss of productivity resulting from careening from one disaster to another. This could be a result of “burnout,” increased absenteeism, time spent in abnormal operations, chronic envi- ronmental illness or injury, excessive worry about family, and so forth. The “Networks” component of the framework could become one of the major stumbling blocks for DOTs. Successfully resilient communities (and states) will require trusted and secure information sharing platforms and communication systems to ensure resilience and sustain- ability in the system. Accomplishing this within and between diverse organizations with differing priorities, missions, and resources will require a new institutional approach. Although this framework is shown as a static architecture, DOTs should recognize that inte- grating the short-term, medium-term, and long-range planning horizons that are needed to respond to long-term climate trends is challenging, particularly because climatic factors are not included in the NEPA process. Each environmental hazard has a short-term (hours-months), inter- mediate (years to decades), and long-range (decades and longer) resilience dimension roughly corresponding to maintenance and operations, engineering, and planning responsibilities. These dimensions are related and influence each other. Visualize the framework as a 3-dimensional dynamic entity where every resilience element, risk factor, and resilience strategy moves through a temporal dimension that stretches decades into the future. This multi-dimensional perspective will tax even the most mature of today’s enterprise risk management approaches. Note also that transportation is just one of a set of interdependent critical infrastructures that are also affected by climate extremes and are concurrently developing their resiliency plans. As an example, consider the many interdependent relationships between transportation and the energy sector. An active Atlantic hurricane season that damages ports along the Gulf of Mexico also may have an impact on refining facilities, thus affecting fuel availability and prices far away from the storm path. Similarly, extreme weather events that disrupt the fuel supply for electric generating facilities result in cascading transportation system impacts from black- outs or brownouts. Understanding Regional Differences AASHTO and its member states have long maintained a delicate balance between the desire for national uniformity and the need to recognize local differences. This balance is further strained by the dawning recognition that many places in the nation lack the resources to either recover from or adapt to environmental disasters yet can no longer rely on outside resources to be made whole. At the same time, the interdependencies between various infrastructure sectors preclude a DOT from implementing resilience in a vacuum.

36 Transportation System Resilience: Research Roadmap and White Papers These factors imply that a “one-size-fits-all” approach to resilience is neither desirable nor achievable. Large urbanized areas of the country, or megaregions, have far greater resources to recover from or adapt to environmental disaster than do second-tier municipalities and rural areas or “underperforming” regions. Although federal and state relief funds have been histori- cally used in an attempt to equalize this disparity, those funds are no longer guaranteed. New Orleans’ post-Katrina experience provides stark evidence to those who doubt this assertion. • Forecasts of population growth in the United States show the total population increasing 40% to 430 million people by the year 2050. Throughout the nation, this new growth will primarily be concentrated in 8 to 10 emerging “megaregions”—large networks of metro- politan areas connected by cultural, environmental, and economic characteristics, as well as by shared infrastructures, including transportation (Figure 2-7). Between now and the year 2050, more than half of the nation’s population growth and as much as two-thirds of its economic growth will occur in megaregions. Today, megaregions contain 31% of all the counties in the United States, 26% of the square miles of the country, and 74% of the country’s population. • In contrast, underperforming regions are those which are below national averages in terms of population growth, employment, and wages. As depicted in Figure 2-8, the majority of these underperforming areas are located in small rural states, the South, the Great Plains, the northern Rockies, and the Rustbelt area surrounding the Great Lakes. Source: Maps by America 2050.org Figure 2-7. Emerging megaregions in the United States.

Understanding Transportation Resilience: An Environmental Perspective 37   • Extended transportation and communication networks of metropolitan centers and their sur- rounding areas often cross municipal, county, tribal, and state boundaries, creating numerous operational interdependencies and challenges. These challenges reach across traditional juris- dictional boundaries, making current resilience planning strategies and governance models grossly inadequate. As a consequence elected officials, along with infrastructure executives, including DOT leaders, should be prepared to collaborate across many institutional and administrative lines. Environmental Resilience Summary for Transportation Policy Makers Weather-related disruptions or loss of services, particularly when viewed as preventable, erode public trust, impact local and regional economies, and generate significant criticism from elected officials, the media, and the traveling public. Resilience refers to the ability to recover from or adapt to significant disruptive events. Resil- ience management is an integrated infrastructure investment and operational strategy designed to maintain or restore functionality that would otherwise be compromised. Figure 2-8. Underperforming regions in the United States. Source: Maps by America 2050.org

38 Transportation System Resilience: Research Roadmap and White Papers Resilience management leverages pre-existing risk management frameworks, although resil- ience and risk are not the same things. Resilience-enhancing recommendations are reflected in updated emergency operations plans, revisions to engineering standards, and in statewide and metropolitan transportation planning processes. Resilience management has short-term (hours-months), intermediate (years to decades), and long-range (decades and longer) dimensions roughly corresponding to operations, engineering, and planning responsibilities. These dimensions are dynamic and interrelated. A national, “one-size-fits-all” resilience strategy is neither desirable nor achievable. The emerging, resource-rich, urban “megaregions” have many more resilience options than do “underperforming,” mostly rural regions. This gap between the “haves” and the “have-nots” is projected to widen over the next century. Engaging Environmental Resilience Although the need for a more effective set of short- and long-term resilience strategies is increasingly obvious and urgent, many political, institutional, scientific, and technical barriers exist. Finding creative ways to overcome these barriers is a critical challenge for transportation leadership. As presented in this discussion paper, environmental issues arise within three time frames: (1) immediate, (2) over the lifetime of individual assets, and (3) over very long periods. This framing corresponds with the asset management life-cycle and with organizational structures focused on operations, engineering, and planning distinctions. The following discussion questions were derived from common barriers that organizations identified they encounter as they attempt to develop and introduce more formal resilience management approaches. The questions listed are intended to provide a basis for fruitful discus- sion. Recommendations already exist for addressing some of these questions (see Appendix C); addressing other questions will require new research projects. • How have the impacts of environmental change affected your state in the past? What envi- ronmental impacts do you project affecting your full set of modal assets, networks, and systems over the next 5 years, 10 years, and 50 years? Have you considered beneficial aspects as well as harmful ones? • Do you have policies and plans in place that address these impacts from operations, program delivery, and long-range planning perspectives? • Do you have a strategy for overcoming the polarization and politicization of environmental topics such as climate change? • Do you have a plan for integrating environmental resilience into your agency culture, mission, customer service objectives, business planning priorities, asset performance measures, or other strategic initiatives? • Environmental disasters take a human toll on employees. Are you prepared for post-disaster employee trauma, burnout, absenteeism, relocation stress, and other effects? • How will you resolve the conflict between resilience and value engineering objectives in your project delivery process? • Are you supporting AASHTO, TRB, and ITE resilience initiatives? Are you investing in resilience-focused education and training for your executive staff, your employees, and your business partners? • What will it take for you to personally own this issue?

39   This section of NCHRP Research Report 975 has been written for transportation policy makers and executives to provide a mechanism by which they can engage their peers together with elected and appointed officials who may be unfamiliar with the conversation surrounding trans- portation resilience. The contents of this section address three critical questions: 1. What is an economic perspective of transportation resilience? 2. Why is this issue critical or important to my agency and me? 3. What do you want me to do about it? Of necessity, the treatment of these questions is both broad and brief. Additional discussion can be discovered from many sources, including the following: • NCHRP Research Report 970: Mainstreaming System Resilience Concepts into Transportation Agencies: A Guide (Dorney et al. 2021); • NCHRP Research Report 976: Resilience Primer for Transportation Executives (Matherly et al. 2021); • CRP programs for an economic perspective, see especially the NCRRP; • TRB; • The National Academies of Sciences, Engineering, and Medicine; • FHWA; and • U.S. DOT. The contents in this section do not of themselves constitute a roadmap for change. Rather, they provide a discussion tool that is meant to help shape the topic and plot a short-term for- ward course. The discussion will not include a lengthy presentation of what resilience is or how it is defined. That subject has been covered in a previous AASHTO report, Understanding Transportation Resilience: A 2016–2018 Roadmap for Security, Emergency Management, and Infrastructure Protection in Transportation Resilience (Fletcher and Ekern 2017). The reader is encouraged to also review the contractor’s final report that provided the basis for the AASHTO publication. The contractor’s report is available at http://www.trb.org by searching “NCHRP Project 20-59(14)C. Contractor’s Final Report.” Essential Points • Although the nation’s transportation systems are generally reliable, disruptions to transporta- tion services are becoming more frequent, of longer duration, affecting more people, and are increasingly more expensive to resolve. • The most common causes of these disruptions are flooding—including seasonal flooding, storm-related flooding, and tidal flooding. Ninety-eight percent of all U.S. counties have experienced flooding at some point in their history. Understanding Transportation Resilience: An Economic Perspective

40 Transportation System Resilience: Research Roadmap and White Papers • Sea-level rise will result in increased tidal flooding, storm surge, and greater wave action, and is projected to become the greatest threat to all U.S. coastal regions in the future. The consequences of this climate-related phenomenon will affect all states to varying degrees. • In all cases, the lack of transportation systems resiliency to these threats becomes an impedi- ment to accomplishing all transportation system objectives over all planning horizons. Although short-term weather operations and traffic incident responses have improved dra- matically over the past 15 years, a systemic lack of common approaches to transportation resilience is imperiling long-range, multi-agency investments. • Resilience is not an independent systems objective but is an “objectives multiplier” affecting all other community and agency transportation objectives, such as system availability, acces- sibility, connectivity, safety, and so forth. • State DOTs play a supporting role in local and regional community development and long- range planning processes that ultimately determine transportation resilience priorities. • State DOTs and other agencies need to be mindful that certain resilience strategies, in general, may be unequally available and therefore inherently inequitable. Some communities have greater access to resources than others, giving them a wider range of options. Moreover, allo- cating public funding based on risk alone may “reward” some places at the expense of others. • Improving the resilience of the nation’s transportation systems is undeniably a benefit to society and a precautionary approach to potential adverse events (i.e., hazard mitigation) is justified in many situations. However, the decision maker needs to balance the proportion- ality of the risk with the cost and feasibility of other competing investment opportunities and benefits. Integrating resilience into structured risk-based asset management programs provides one mechanism to accomplish this. Introduction The garden harvests of the early 1890s were fascinating to Italian engineers, sociologists, economists, and political scientists—and to philosopher Vilfredo Pareto. Not only did they provide food for his young family, but the ever-curious Pareto noticed that roughly 80% of all his peas were coming from only about 20% of his peapods. In 1896, he applied this insight to property ownership and again found that 80% of all real estate in Italy was owned by just 20% of the population. By the turn of the 20th century, Pareto was busy documenting similar relationships for many other political and social issues of his day. Almost 50 years later, American engineer and management consultant Joseph Juran dis- covered Pareto’s work and began applying it successfully to various quality control problems. He went on to suggest both a new management principle and its name: the Pareto Principle— also known as the 80/20 Rule. Stated simply the rule suggests that for many phenomena, 80% of the effects come from only 20% of the causes. The importance of this insight is intuitively obvious in our discussion of the economics of transportation resilience. Rather than trying to make the entire transportation infrastructure resilient to all hazards—which is both too expensive and too time-consuming—or randomly deploying ad hoc resilience strategies as events unfold—which is too inefficient and may be too late—the 80/20 rule suggests that by addressing the 20% of the hazards that are responsible for 80% of transportation disruptions, agencies can focus scarce resources most effectively and achieve an optimal level of resilience. The Main Thing: A Matter of Priorities Management guru Stephen Covey once advised that “The main thing is to keep the main thing the main thing.” And the main thing to worry about in a resilient transportation system is water, specifically too much of it in the wrong place. Although winter storms, high winds, heatwaves,

Understanding Transportation Resilience: An Economic Perspective 41   earthquakes, and other extreme environmental conditions can and do disrupt travel or damage infrastructure, flooding is by far the most frequent and expensive environmental hazard to the infrastructure. According to an article published by the Pew Charitable Trusts (Lightbody 2017), [f]looding is the costliest and most common natural disaster in the U.S., claiming lives, inflicting financial losses on households and businesses, and straining the government agencies that provide flood response and relief. From 1980 to 2013, flooding cost Americans more than $260 billion in damage; from 2006 to 2015, federal flood insurance claims averaged $1.9 billion annually. The pattern continued in 2016, with the federal government declaring 36 disasters involving floods or hurricanes. For those who believe that they are immune because they live inland or in arid parts of the country, according to the Federal Emergency Management Agency (FEMA), floods have occurred in 98% of all U.S. counties at some time, making this an issue of national significance. Table 2-3 summarizes more than 37 years of billion-dollar weather- and climate-related dis- asters that have occurred in the United States. Ignoring droughts and heatwaves, which have lesser effects on surface transportation, 81% of these mega-disasters were related to severe storms or flooding. Recent trends indicate that the total losses due to these events are increasing. This finding may be due to a combination of factors, including • A growing economy means more people and more developed land affected by a given disaster; • Rising construction costs, particularly after major disasters, inflate replacement costs; • The country continues developing in more vulnerable places such as coastlines, often elimi- nating their natural resilience (e.g., wetlands, barrier islands); • National Flood Insurance Program subsidies may encourage irresponsible behavior; • Current disaster funding is skewed towards least prepared states; and • The frequency and severity of natural disasters are increasing. From a transportation-centric perspective, Table 2-4 provides another illustration of the Pareto Principle and suggests a strategy for proceeding with our discussion of the economics of transportation resilience. In FY 2017, 31 states received a total of $670 million in FHWA Emergency Relief funds where roughly 80% of these events were related to storm or flooding damage. Previous FY emergency allocations show the same pattern. By the end of the 21st century, the most serious environmental threat to the nation is likely to be sea-level rise. Almost the entire U.S. coastline is projected to be affected to some degree, experiencing elevated water levels in the range of 1–8 feet depending on location and resulting in more frequent tidal flooding, greater storm surges, and more damaging wave action. Since sea-level rise is, in part, a consequence of warming oceans, this additional heat will fuel more Table 2-3. Billion-dollar weather disasters, 1980–June 2017. Disaster Type Number of Events CPI- Adjusted Losses (B$) Deaths Storms or Flooding 152 $899.8 5,328 Drought/Heat Waves 24 $232.5 2,993 Wildfire 14 $35.6 184 Winter Storm 14 $42.7 1,013 Freeze 8 $27.3 162 All Disasters 212 $1,237.9 9,680 Source: NOAA (National Centers for Environmental Information)

42 Transportation System Resilience: Research Roadmap and White Papers severe tropical cyclones bringing historic rainfalls and catastrophic winds to mainland U.S. and Caribbean interests. The 2017 Hurricanes Harvey, Irma, and Maria provide a sneak preview of this projected future. The following statistics, from NOAA’s State of the Coast Report, highlight the economic activity and infrastructure at risk from rising seas (NOAA 1998): • $6.6 trillion: Contribution to GDP of the coastal shoreline counties, just under half of U.S. GDP in 2011. • 51 million: Total number of jobs in the coastal shoreline counties of the United States in 2011. • $2.8 trillion: Wages paid out to employees working at establishments in the coastal shoreline counties in 2011. • 39%: Percent of the nation’s total population that lived in coastal watershed counties in 2010 (less than 20 percent of the total land area excluding Alaska). • 34.8 million: Increase in US coastal watershed county population from 1970 to 2010 (or a 39 percent increase). • 446 persons/sq. mi: Average population density of coastal watershed counties (excluding Alaska). Inland density averages 61 persons per square mile. As the effects of rising seas and more extreme weather take an ever-greater toll, citizens, com- munities, and businesses will be increasingly unable to recover and will be forced to abandon damaged areas. The tragic fate of Puerto Rico since Hurricane Maria struck in September 2017 offers a grim harbinger of the future of many communities, absent significant changes to managing critical infrastructure. Notice that while this discussion has focused on flooding, specific regions of the country, communities, and supply chain managers may be exposed to other hazards of greater concern. They are encouraged to apply the Pareto Principle locally. The key takeaway is that all-hazards do not equate to every hazard in all places. An Economics Perspective of Transportation Resilience Transportation economists have long known that the set of roads and streets, bridges, ports and terminals fill multiple roles in the nation’s life (see Figure 2-9). Recalling a few basic facts will be useful when focusing on transportation resilience from an economic perspective. First, the transportation system is a significant national and community asset representing more than U.S. $13.7 trillion of public investment since 1956 and supporting many trillions of dollars more of additional economic activity in the private sector. Indeed, some transportation economists suggest that the average annual rate of return of this investment since the 1950s may have exceeded 18% per year. Table 2-4. 2017 FHWA emergency relief. Event Type Number (%) Allocation ($M) Storms and Flooding 70 (80.5%) $579.7 Fire 5 (5.7%) $19.8 Rock fall/Rockslide 5 (5.7%) $14.3 Bridge Damage 5 (5.7%) $25.3 Other 2 (2.3%) $31.3 Totals 87 (100%) $670.4 Source: FHWA

Understanding Transportation Resilience: An Economic Perspective 43   Since the 1980s, innovative business practices such as just-in-time manufacturing, just-in-time retailing, and e-commerce (i.e., just-in-time delivery) have revolutionized the global economy. Each of these innovations depends on reliable and resilient supply chains that are built on the global transportation infrastructure which is, in turn, also redundant, resilient, and reliable. Secondly and of most interest to state DOTs, is the Highway and Motor Carrier subsector, which includes more than 4 million miles of highways, streets, and roads; 600,000 bridges; 350-plus tunnels; and 142,000 commercial vehicles. Linked together into a seamless network, highways provide a variety of essential services, including accessibility, mobility, and connec- tivity. During emergencies, the transportation network is also called upon to offer specialized lifeline services supporting evacuations of people and goods away from disasters and enabling emergency resources and responders access to disaster-stricken areas. Thirdly, this economic asset resolves into various modal components that together comprise the nation’s transportation systems critical infrastructure—one of 16 “. . . infrastructure sectors whose assets, systems, and networks, whether physical or virtual, are considered so vital to the United States that their incapacitation or destruction would have a debilitating effect on secu- rity, national economic security, national public health or safety, or any combination thereof ” (DHS n.d.). The transportation systems sector is subdivided into seven subsectors or modes, including aviation, highway and motor carrier, maritime, mass transit and passenger rail, pipe- line, freight rail, and postal and shipping. Notice that few state DOTs have operational respon- sibility for all modes within their respective jurisdictions, although these agencies may exert some control or influence as a consequence of specific regulatory or funding relationships. Finally, state DOTs are major purchasers of a wide variety of goods and services, including planning and engineering services, construction services and materials, infrastructure opera- tions and maintenance, and so forth. In some rural areas, they may be a major employer as well. The ability to quickly infuse capital into devastated areas magnifies this economic power, particularly when other kinds of economic activity have been disrupted. Finally, via their state motor vehicle departments, states generate a significant amount of public revenue through licensing, registration, inspection, and other user fees that can be used to fund transportation agency spending. According to the Congressional Budget Office, federal, state, and local government spending for transportation infrastructure totaled $279 billion in 2014, representing about 2.4% of GDP. This level of public funding has remained relatively constant in the post-WWII era. Although the majority of these investments have funded highways ($165 B), governments invested in mass When the resilience framework is applied to cities and regions, a fundamental issue is the type of stress or disturbance affecting the area. Some stresses take the form of acute shocks, often natural or manmade disasters. In other cases, regions face chronic, long term strains, such as the decades of declining employment and population affecting many older American industrial areas. The measures and frames for evaluating resilience vary depending on the type of stress. And because the capacities needed to respond to each form of stress can differ, regions may be more resilient to one type of disturbance than another. —HUD (2012) Figure 2-9. Multiple perspectives of the transportation system.

44 Transportation System Resilience: Research Roadmap and White Papers transit, rail, aviation, and maritime infrastructure, as well. Keynesian economics suggests that this purchasing power has a stimulus effect on the economy. Other economic analyses suggest that this effect is magnified during post-disaster periods, although many economists disagree. To summarize, the economic value of the transportation sector is the sum of the contributions it makes to the economy. These contributions include: • Investments in community assets or infrastructure; • Services provided, such as access, connectivity, mobility, and emergency lifelines; • Economic stimulation, attracting industry and labor and generating commercial activity; • Revenue source (e.g., through federal funds, user fees, taxes); • Provision of a major market for energy, fuel, and materials such as concrete and steel; and • Interdependent enabling and use of other critical infrastructures such as communications, energy, and emergency services. This concept permits an enhanced understanding of transportation resilience: resilience concerns itself not only with the restoration of functional services, but also with preserving or restoring the total economic value of transportation after a major event. Notice that these events may result from natural or manmade disasters or may be the consequence of purely economic forces. Although the specifics vary among states, in general, all states, in cooperation with the federal government, have some combination of the following transportation system objectives guided by the four perspectives just presented: • Improve accessibility, mobility, and connectivity, across all modes, for all users; • Minimize service disruptions; • Preserve asset value; • Protect critical infrastructure components; • Stimulate the economy; and • Maintain interconnectedness with other critical infrastructures. These objectives set the context for transportation resilience, which has been defined as “the ability to prepare and plan for, absorb, recover from, or more successfully adapt to adverse events” (Fletcher and Ekern 2017). Consider the effects of flooding. In all cases, flooding becomes an impediment to accom- plishing all DOT system objectives over all planning horizons. Moreover, flooding does so in some non-linear proportion to the magnitude (i.e., severity and extent) of the inundation. In other words, a flood twice as large will potentially have more than double the consequences. Flooded roads hinder lifeline services during a disaster, but they also may result in a loss of accessibility and mobility over a longer duration, reducing the quality of life and economic vitality of the community. Flooded roads also may result in significant physical damage to the infrastructure, reducing asset value and necessitating accelerated asset improvement projects. The discussion and example highlight a second essential finding: Resilience is not an inde- pendent systems objective but is, instead, an “objectives multiplier” affecting all other objectives. Successful resilience strategies will result in higher levels of access, mobility, and connectivity with fewer, less severe disruptions of service. Asset values will be maintained at lower life-cycle costs, and so on. In other words, resilience is not pursued for its own sake; rather, resilience is pursued in order to meet other objectives. Conversely, a lack of resilience, demonstrated by greater loss and slower recovery, negatively impacts all other aspects of the system’s perfor- mance which affects all other aspects of the community. “Forget the political debate, forget the national debate, forget the debate about the science; think about what you’re seeing right here. You’ve got to do something about it, and you’ve elected us to make decisions; you’ve elected me to make decisions, so I’ve got to do something about it. And then when you get into specific projects, it all makes sense to people.” —Jake Day, Mayor, Salisbury, MD

Understanding Transportation Resilience: An Economic Perspective 45   One of the most common misconceptions concerning resilience is that it is a “yes/no” sort of universal quality. People betray this bias in the way discussions are framed with questions like “Is this bridge resilient? Is the system resilient? Is this community resilient?” The questions themselves imply a static, “yes/no” answer. More sophisticated frames would add nuances to these questions: “Against what kind of adversity? To what degree? Over what period?” The salient point is this: Any discussion of resilience must begin with a thorough under- standing of risk. Although most discussions present single examples of the relationship between risk and resilience, in practice there will be dozens of assessments encompassing multiple com- binations of extents (e.g., asset, corridor, community, region) and threats (e.g., acute and long term, natural/human-caused, physical/economic shock). Each risk assessment seeks to quan- tify both the likelihood and the severity of adverse events using a combination of historical statistics and various forecasting methods. In general, the greater the likelihood of something happening to the system and the more severe the consequences of that event, the greater the risk is assessed to be. Portions of the infrastructure that are at extreme risk (i.e., the event is almost certain and the consequences include significant loss of life or property) require immediate action where normal resilience activities may be too late. Conversely, those portions deemed to be low risk can be dealt with on an ad hoc basis and resilience investments may be too expensive. After these risk “tails” have been eliminated, risk reduction strategies for the remainder of the system can then be developed and deployed. Transportation risk managers draw upon a variety of measures to reduce risk. Although these measures are both hazard- and site-specific, they all are aimed at reducing risk by • Reducing the cause(s) or likelihood of adverse events, or • Reducing the vulnerability (exposure) to hazard(s), or • Reducing the severity of the consequences(s). Implicit in these choices is the opportunity to improve the resilience of that component, cor- ridor, or region relative to a particular risk. In other words, improving the ability to preserve or recover system value by defending, adapting, or moving system components reduces system vulnerability and the severity of post-disruption effects, thereby reducing risk. Average time-to-recover, percent-loss-of-service, loss recovery curves, and other measures incorporate this concept. The idea is that pre-disturbance there exists some known “business- as-usual” level of performance. When an acute disturbance occurs, such as a severe storm with flooding, the system experiences some loss of functionality that requires some time necessary to fully recover (if ever). More resilient systems will experience less loss of performance and shorter recovery times than less resilient ones due to prior resilience investments. The difference between loss-of-functionality before and after resilience mitigation represents the total benefits realized by a more resilient system. Some of these benefits may include: • Shorter recovery time, • Less loss of function, and • Lower recovery costs. The fundamental issue is to develop an investment strategy that balances resilience investments with competing interests such as asset preservation, capacity expansion, safety, economic stim- ulus, and so forth. In many projects, these goals are either completely aligned, requiring no addi- tional investment, or can be harmonized with only marginal investment costs. The loss-recovery

46 Transportation System Resilience: Research Roadmap and White Papers curve can also apply to the local economy. State DOTs have a unique capacity to minimize the depth of loss of economic activity by reprioritizing DOT investments in the affected area. The point is that every dollar invested in resilience today may save multiple dollars in future emergency response and recovery costs. These savings increase as transportation risks increase. Improving the resilience of the nation’s transportation systems is undeniably a benefit to society, and a precautionary approach to potential adverse events is justified in many situations; how- ever, community leaders need to balance the proportionality of the risk with the cost and fea- sibility of other competing investment opportunities. Although not specifically labeled as such, over the past 15 years, DOTs, along with their partner organizations, have made a great deal of progress in improving the resilience of the system. Scalable, adaptive approaches to emergency operations and incident management are now operationalized in every state, to varying degrees. New threats (e.g., sea-level rise) are rec- ognized by those affected and adaptation strategies are evolving in some states. However, the severity, duration, and extent of disruptive events are increasing and challenging the abilities of communities and agencies to respond. A secondary cautionary note is important to recognize: Resilience investments are, in gen- eral, inherently inequitable. Certain communities, states, and megaregions, by definition, have access to resources that are unavailable to underperforming places, giving them a wider range of options. For example, building multi-million-dollar stormwater systems that are coupled with expensive levees and other flood control public works may be totally out of reach for many states and communities. And all too often, rescue, response, and recovery resources are unevenly distributed to the benefit of some and the detriment of others. Moreover, allocating public funding based on risk alone rewards some places at the expense of others. Given that the risk for any specific hazard is unevenly distributed in space and time, risk reduction and resilience-enhancing investments will also be unevenly distributed. Finally, the national trend to “socialize losses, privatize gains” inadvertently creates a moral hazard for those living in high-risk areas, distorts economic values, and ultimately increases costs for all states. Because transportation funding is essentially a zero-sum game, particular care should be exercised to ensure that the nation ends up doing well as it attempts to do good. Building Resilient Asset Management Although the most visible evidence of transportation resilience is often seen during severe weather operations, resilience management encompasses an integrated suite of management and technical approaches dealing with defending, adapting, or even abandoning critical infra- structure. The greatest gains in systems resilience occur when these activities are seamlessly woven into an agency’s asset management, risk management, and performance management practices. According to the FHWA, transportation asset management (TAM) is a strategic and system- atic process of operating, maintaining, upgrading, and expanding physical assets effectively throughout their life cycle. TAM is a business model, a decision support system, and a manage- ment approach that can be used across an agency to address five core questions: 1. What is the current state of physical assets? 2. What are the required levels of service and performance delivery? 3. Which assets are critical to sustained performance? 4. What are the best investment strategies for operations, maintenance, replacements, and improvement? 5. What is the best long-term funding strategy?

Understanding Transportation Resilience: An Economic Perspective 47   Integrating resilience management and asset management processes provides the following immediate benefits to a DOT: 1. Accurate inventories of assets and their pre-disaster condition; 2. Sound maintenance practices within an asset management regime “hardens” assets; 3. The hierarchal prioritization of critical assets conducted in a risk-based asset management program provides priorities for asset repair after events; 4. Asset management and operations staff become competent at asset management scenario planning, which is critical when developing a post-event recovery plan; 5. Sound asset inventories and good unit-cost data assist with estimating recovery costs; 6. Complete and accurate data allow the faster development of contract plans immediately after an event; and 7. Risk management capability provides not only critical before-event prioritization but also is useful in post-event recovery allocation of resources. The Business Case for Resilience Unfortunately, due to a lack of uniform national information documenting costs and ben- efits of various mitigation strategies, no specific values can be assigned to before-the-event investments. However, a study recently released by the National Institute of Building Sciences (NIBS)—the Natural Hazard Mitigation Saves: 2017 Interim Report—suggests that for every dollar invested in mitigation, society saves somewhere between $4 and $6 (Multihazard Mitiga- tion Council 2017). In the NIBS study, costs were defined to include up-front construction and ongoing mainte- nance over a 75-year economic lifespan to improve existing facilities or the additional up-front cost to build replacement facilities better. Benefits referred to the present value of the reduction in future losses due to mitigation. Benefits pertinent to transportation mitigation included reductions in • Deaths, injuries, and PTSD; • Repair costs; • Loss of revenue and other business-interruption costs; • Loss of income to residents; • Loss of economic activity in the broader community; • Loss of transportation services; and • Costs for search and rescue. Engaging Economic Resilience Although the need for a more effective set of short- and long-term resilience strategies is increasingly obvious and urgent, many political, institutional, scientific, financial, and technical barriers exist. Finding creative ways to overcome these barriers is a critical challenge for trans- portation leadership. The following discussion questions were derived from common barriers that organizations identified they encounter as they attempt to develop and introduce more formal resilience manage- ment approaches. The questions listed are intended to provide a basis for fruitful discussion. Recommendations already exist for addressing some of these questions (see Appendix C); addressing other questions will require new research projects. • Do you know the current and projected flooding risk and subsequent loss of value for your system? Do you know how this risk affects individual assets (e.g., bridge), community/ corridor, regional, statewide, or multistate areas?

48 Transportation System Resilience: Research Roadmap and White Papers • Have you implemented formal asset management, performance management, and risk management approaches in your agency? Are these functions coordinated with each other? Are they coordinated with your traditional long-range planning, program delivery, and oper- ations functions? • Have you integrated resilience requirements in these management systems? • How will you resolve the conflict between resilience investments and value engineering objectives in your project delivery process? • Do you have community and statewide plans reflecting integrated infrastructure recovery and mitigation priorities? • Are you supporting AASHTO, TRB, and ITE resilience initiatives? Are you investing in resilience-focused education and training for your executive staff, your employees, and your business partners? • What will it take for you to personally own this issue?

49   This section of NCHRP Research Report 975 has been written for transportation policy makers and executives to provide a mechanism by which they can engage their peers together with elected and appointed officials who may be unfamiliar with the conversation surrounding trans- portation resilience. The contents of this section address three critical questions: 1. What is a cyber perspective of transportation resilience? 2. Why is this issue critical or important to my agency and me? 3. What do you want me to do about it? Of necessity, the treatment of these questions is both broad and brief. Additional discussion can be discovered from many sources, including the following: • NCHRP Research Report 930: Update of Security 101: A Physical Security and Cybersecurity Primer for Transportation Agencies (Countermeasures Assessment & Security Experts, LLC, and Western Management and Consulting, LLC. 2020); • NCHRP Research Report 976: Resilience Primer for Transportation Executives (Matherly et al. 2021); • NCHRP Research Report 970: Mainstreaming System Resilience Concepts into Transportation Agencies: A Guide (Dorney et al. 2021); • TRB; • The National Academies of Sciences, Engineering, and Medicine; • FHWA; • DHS; and • NIST. Essential Points • For the past 60 years, state DOTs have embraced cyber-driven innovation. • Over that period, DOTs have invested in three generations of overlapping technology: (1): IT, or information (i.e., data processing) technology; (2) OT, or operational (i.e., control systems) technology; and (3) CT, or consumer technology (i.e., technology used by people for their personal use). • Even as technology-enabled transportation has produced many benefits to these agencies and the nation, each wave of innovation has introduced greater risk to the transportation system as users grow increasingly dependent on increasingly vulnerable and complex technologies over which DOTs have steadily lost control. • In response, DOTs are deploying two complementary strategies—cybersecurity and cyber resilience—to improve performance, reduce risk, and maintain the trust of their communities. Understanding Transportation Resilience: A Cyber Perspective

50 Transportation System Resilience: Research Roadmap and White Papers • Cybersecurity is not the same mission as cyber resilience. Cybersecurity focuses on protecting the confidentiality, integrity, and availability of data; cyber resilience focuses on preserving or restoring transportation and agency operations. • Cyber resilience is not a “thing.” Instead, it is a consequence of political, strategic, and opera- tional decisions made by elected officials and senior agency managers and is embedded in agency business policies, plans, processes, and workflows. • Senior DOT leadership needs to establish, promote, and enhance those core values associated with resilience in general and cyber resilience in particular. • The starting point for cyber resilience planning is to assume that cyber incidents will occur and will degrade, disable, or destroy not only digital assets but parts of the physical transpor- tation infrastructure as well. • Cyber incidents are becoming more frequent, more disruptive, and more costly, and DOTs no longer have the ability or the resources to mitigate this situation on their own. • Although DOTs have significant roles to play in restoring transportation services and func- tions after a cyber incident, in many cases the DOT will not be the lead agency, and DOTs will need to closely coordinate, collaborate, and communicate with others. Bonus: Cyber resilience is not primarily a technical problem—it is an ongoing predicament that requires constant management and oversight. What Is Past Is Prologue Looked at from any point of view, it was the most improbable set of circumstances. And—like many technological revolutions—this one was also driven by war: specifically, the Korean War. When the Korean War ended in 1953, thousands of young civil engineers demobilized and resumed their civilian careers, many of them in federal and state highway agencies. They had seen the world, and now they were looking for new challenges at home. Coincidently, that same year IBM announced the IBM 650 Magnetic Drum Data-Processing Machine, an intermediate sized computer capable of performing both business and scientific computations. The IBM 650 quickly established itself as the computing standard in universities, businesses, and government agencies, and it became the most popular computer of the 1950s. Many state highway agencies, including agencies in California, Iowa, Texas, Washington, and Wisconsin, purchased the IBM 650 to support various labor-intensive data processing activities. Two years later, MIT hired a young assistant professor of surveying named Charles L. Miller. Miller, who would later become chair of MIT’s Civil Engineering Department, was exposed to a variety of post-war military-sponsored computer research and was quick to see the potential of applying computers to civil and transportation engineering problems, specifically to surveying, photogrammetry, and roadway design calculations. He would spend the next 40 years devel- oping software and educating engineers as the “father” of automated civil engineering. Meanwhile, President Dwight D. Eisenhower, motivated by his participation in the 1919 U.S. Army’s Transcontinental Motor Convoy, his WWII experiences with the German autobahn system, and his desire to divert the country’s attention from the stalemate in Korea, pushed for and ultimately signed the $25 billion National Interstate and Defense Highways Act of 1956. This legislation called for the construction of 41,000 miles of interstate highways to be completed over the next decade. All of the ingredients were now in place for an inevitable explosion of innovation within state highway agencies (see Table 2-5). They had a cadre of ambitious veterans eager to take on new challenges. They had become early adopters of emerging technologies, making significant

Understanding Transportation Resilience: A Cyber Perspective 51   investments in the earliest commercial computers, and they had access to surveying and design software developed by the leading university civil engineering department of its day. Perhaps most importantly, they had been given a grand mission, along with a big checkbook. In support of this mission, state DOTs would go on to establish the Highway Engineering Exchange Program (HEEP), a DOT-driven technology peer exchange forum, in 1959, and the AASHTOWare program, a DOT-funded software development cooperative, in the early 1970s. Both initiatives were integral factors in the successful diffusion of emerging transportation tech- nologies throughout the DOT community, and they remain active today. All of which is to point out that cyber-driven innovation is woven tightly into the fabric of the modern state DOT. Not only did those first-generation engineers learn how to transform primitive digital technology into productivity gains, but they also learned painful lessons about cyber reliability and cyber resilience. Critical Cyber Trends for Transportation Policy Makers After 50 years of pressure from the inexorable effects of Moore’s Law, which holds that the number of transistors on a chip doubles about every 2 years while the cost is halved, the cyber universe has evolved into roughly three overlapping “habitats” or domains: IT (information technology, also called data processing); OT (operational technology, also called control systems); and CT (consumer technology, meaning technology used by people for their personal use). Not surprisingly, significant overlaps exist among these domains. (Figure 2-10) In the early years of IT, DOTs installed and operated all of their computing resources in- house and in most cases developed all of their custom application software using DOT program- mers. The primary focus of IT was data processing, storage, and reporting, and the primary risks to this mission were losses of data integrity, confidentiality, and availability. Cyber resilience meant maintaining mainframe uptime and doing nightly data backups; cybersecurity was pri- marily focused on environmental threats to the data center such as heat, fire, and flooding; and the DOT cyber ecosystem consisted of a small number of highly trusted vendors, developers, Cyber Milestone Year Introduced Units (worldwide) Degree of User Control Dawn of DOT Computing 1953 NA Very High Mainframes 1965 10 K High Personal Computers 1983 2 B Moderate Web Browsers 1994 2-3 B Moderate Smartphones 2007 2.7 B Low Embedded Computing (Internet of Things) 2010 12.5 B Very Low Table 2-5. DOT computing milestones.

52 Transportation System Resilience: Research Roadmap and White Papers operators, and users with well-defined roles and responsibilities. Although many improvements to IT have been made over the past 60+ years, the original IT emphases—collect the data, process the data, protect the data—have remained constant. Each subsequent generation of IT innovation has enabled DOTs to offer increasingly com- plex digital products and services in almost every one of its business areas. Table 2-6 high- lights a few examples from DOTs across the country. Although not perhaps intended by those responsible for it, the transportation “business” has become not only cyber-enabled but is now heavily cyber-dependent. Even a cursory review of the example systems suggests that cyber- failure means agency and transportation system failure, putting individuals, businesses, and communities at risk. Figure 2-10. Technology domains. Table 2-6. DOT cyber functions. Source: CASE™, LLC and Western Management Consulting, LLC. (2016)

Understanding Transportation Resilience: A Cyber Perspective 53   The advent of the Internet combined with the conversion of con- trol systems from analog to digital components, ushered in the age of operational technology (OT), sometimes referred to as industrial con- trol systems (ICS). Although these systems sometimes share compo- nents with IT, they are distinguished from IT systems by their ability to monitor and control (i.e., alter) the state of things in the physical world. Common examples of OT used in surface transportation include highway signal and signage systems, tunnel ventilation and fire sup- pression systems, road weather systems, and railroad crossing safety equipment. Unfortunately, as OT systems and components made the shift from analog to digital architectures, OT cybersecurity and cyber resilience design requirements were often overlooked (see text box). The results of OT failures have immediate real-world consequences involving human safety, property damage, or loss of equipment. These risks increase as OT moves into the harsh reality of the roadside environment that poses additional security, reliability, and resilience challenges, such as: • Cyber-attack (e.g., hack, malware, viruses, distributed denial of service [DDOS], ransomware); • Construction/maintenance damage; • Software updates and patches; • Earth movement (e.g., avalanche, rock fall, landslide); • Extreme weather (e.g., rain, snow, ice, wind, heat); • Fire; • Flooding (e.g., storm surge, sea-level rise); • Space weather (solar storm/coronal mass ejection); • Spoofing/jamming; • Theft/vandalism; • Operator error; • Sensor/actuator/processor failure; and • Vehicle/vessel impact. In addition, the growth of the DOT cyber ecosystem introduces additional risk into agency operations. In many DOTs, OT is characterized by less technically experienced personnel oper- ating black-box components communicating over insecure networks, all of which had been sup- plied by an increasingly large number of unvetted vendors and consultants. Loss of control and loss of visibility are additional risks added to the previously mentioned potential for loss of data integrity, confidentiality, and availability. In all cases, cyber failures are accompanied by a loss of trust in the agency and in government in general. Analyses of recent major hacking events suggest that the erosion of trust is a primary objective of the attackers. Innovations in processor and storage miniaturization and in wireless broadband and cellular communications have resulted in a third type of technology: consumer technology (CT) some- times known as the Internet of Things (IoT). This modern era, beginning in 2007 with the intro- duction of the Apple iPhone, is characterized by billions of inexpensive devices connected to the global “cloud” and is exemplified by the smartphone, tablet computer, and smart speaker. A mind-boggling measure of just how far CT has progressed is that the 2010 Apple iPhone 4 had roughly the same raw processing power as a 1985 Cray-2 Supercomputer. Similar to the impact that IT and OT had in earlier times, CT is creating another set of sig- nificant disruptions within DOTs and other transportation organizations. Employees, travelers, shippers, carriers, citizens, and almost everyone else increasingly expect to have access to and seamlessly interact with the full range of DOT-supplied IT and OT services using a variety of Beckstrom’s Laws • Law 1: Everything that is connected to the Internet can be hacked. • Law 2: Everything is being connected to the Internet. • Law 3: Everything else follows from the first two laws.

54 Transportation System Resilience: Research Roadmap and White Papers devices, apps, platforms, and social media. People want to renew their auto registration, know when their street will be plowed, what time the next bus is, and the fastest way to get to work. And they want to know it immediately on their phone. Not surprisingly, this technology bazaar also attracts pranksters, criminals, hacktivists, and nation-state adversaries. Chaos is the order of the day, trust is the coin of the realm, and DOTs, along with every other enterprise with digital assets, are trying to adapt. In this new world, not only are IT data, OT controls, and CT privacy at risk, but enterprises are staking their reputations and risk losing the trust of their constitu- ents if they can’t deliver or if they violate constantly shifting behavioral norms such as losing personally identifiable information, for example. History, of course, doesn’t end with the present. The next generation of disruptive technology is already in the test beds and business plans of the visionary and the ambitious. Although picking winners in the innovation derby is a mug’s game, some combination of autonomous vehicles, all-electric drive trains, and collaborative consumption (i.e., mobility-on-demand) business models appear likely in the near term. According to the U.S. National Science Founda- tion, these cyber-physical systems (CPS) are physical and software components that are “deeply intertwined, each operating on different spatial and temporal scales, exhibiting multiple and distinct behavioral modalities, and interacting with each other in a myriad of ways that change with context” (NSF 2008). Proposed examples of CPS involving transportation include smart cities, smart power grids, automated and connected vehicles, and construction and maintenance robotics, all of which are currently in some stage of research and development. However, eco- nomic constraints, social equitability concerns, and political gridlock may impede the deploy- ment of these systems, at least in the United States. Even if the specifics of future transportation technologies are unknown, cyber incidents will certainly continue to increase, the consequences of cyber failure will become increasingly costly, and the demands for greater cybersecurity, reliability, and resilience will correspondingly grow. The DOTs’ collective inability to meet the demands in this new world will perhaps risk the loss of the entire franchise and lead to the total privatization of the transportation industry. Over the past 60+ years, state DOTs have successfully absorbed two waves of cyber innovation— IT and OT. Agencies now are in the middle of integrating a third wave, CT. A fourth wave, CPS, is already visible on the horizon and is expected to arrive in some places around 2025. It is important to note that the first of these deployments may not be by or in U.S. cities or states. This activity has already created an unbreakable linkage between the transportation systems infrastructure and the IT infrastructure. That is, it is no longer possible to address transporta- tion systems security, reliability, or resilience without simultaneously addressing cybersecurity, reliability, and resilience. The widespread adoption of fourth-wave technology will ultimately make the distinction between these two infrastructures arbitrary and meaningless. Although each wave has resulted in net positive benefits to agencies and their constituents, two reinforcing trends are troubling: 1. Each wave of innovation has resulted in greater risk to the agency’s mission, its customers, and its assets as agencies grow increasingly dependent on increasingly vulnerable and complex technology. All dimensions of the risk equation are increasing (i.e., the threats, the exposure, and the consequences of failure), although the magnitude of their increases is uncertain. 2. At the same time, each wave has resulted in less control by a DOT over the technology it relies upon. Thirty years ago, state DOTs owned and operated all of their computers while storing all of their data in-house. Today, fewer than half do. DOTs have slowly evolved from being technology owners to technology customers, while the technical staff at the DOTs have shifted from being system developers to system users. The likely conclusion of this trend is

Understanding Transportation Resilience: A Cyber Perspective 55   that DOTs will continue to bear all the responsibility for cyber-based transportation services while continuously losing more of the necessary resources, knowledge, and authority to do so. Cybersecurity or Cyber Resilience? In general, enterprises—including state DOTs—have adopted two complementary approaches to managing cyber risks. These approaches are broadly referred to as cybersecurity and cyber resilience. Although similar in some of their technologies and practices, cybersecurity and cyber resil- ience are distinct concepts. Whereas cybersecurity focuses on the protection of digital assets (e.g., data, software, systems, networks, and equipment), cyber resilience focuses on preparing for, absorbing, recovering from, or adapting to adverse cyber events to continue the provision of digital products and services. In this context, cyber resilience is only meaningful in terms of pre- serving or restoring cyber-dependent business and transportation operations and is not focused on incidents that are intended to steal data. Of course, once an agency’s data have been compro- mised or stolen (i.e., once the agency’s security has been breached), resilience is irrelevant. Historically, organizations, the media, and the public have primarily been concerned with cybersecurity. That is, they have been concerned with the methods of protecting computing assets and data from unauthorized access, exploitation, damage, or loss. Although “bad guy” actors get most of the security publicity, many natural events can also disrupt digital services and cause inadvertent loss of function. Not surprisingly, government agencies—including state DOTs— have invested thousands of hours and millions of dollars in cybersecurity training, equipment, software, and data attempting to protect human life and safety, environmental quality, constit- uent privacy, and the billions of dollars of cyber assets from a myriad of adverse events. Except that it’s not enough. It will never be enough. Computer security experts admit the truth of the adage attributed to former Cisco CEO John Chambers: “There are only two types of companies in the world. Those that have already experi- enced a cyber breach and those that are going to.” Replace the word “companies” with the word “systems,” and the statement holds. The bad guys are getting smarter, equipment breaks, and people make mistakes. The world is flooding where it never used to and it’s hotter than ever causing electronic devices to malfunc- tion in unpredictable ways. And even if an agency could identify every single hazard facing every single piece of digital equipment and every bit of data, the agency will never have the time, talent, or resources to secure the agency against all of those hazards. By all means, it is important to practice good cyber hygiene, adopt industry best security practices, hire a cybersecurity expert, invest in firewalls and antivirus software, monitor your network, test your defenses, and train agency staff. Again, it is not enough. It might be prudent to have a plan for when a cyber crisis happens and it all goes pear-shaped. It might also pay to invest in the ability to limit the scope of the consequences of cyber failure and to know how to continuously deliver on the transportation mission at all times despite adverse cyber events, even when normal digital operations have failed. This ability of digital components (i.e., systems, networks, technology, applications, and data) of the transportation system to recover and regain functionality after a major disruption or disaster is referred to as Today we were unlucky, but remember we only have to be lucky once. You will have to be lucky always. —Irish Republican Army communiqué, 1984 There are only two types of companies in the world. Those that have already experienced a cyber breach and those that are going to. —John Chambers, former CEO of Cisco

56 Transportation System Resilience: Research Roadmap and White Papers cyber resilience. Cyber resilience also includes the ability to continuously adapt (i.e., change or modify) regular cyber delivery mechanisms as needed in the face of new risks. Faces of Cyber Resilience The application of the term cyber to qualify various aspects of agency leadership and manage- ment is unfortunate because the term tends to reinforce the myth that all situations designated cyber are technical in nature. This belief, of course, implies that their solutions are also technical and that the responsibility for both the situation and the solution lies with the “cyber” part of the organization. Cyber resilience is not a “thing” at all; rather, it is a trailing-edge indicator of the political and strategic decisions that are embedded in agency business processes. In other words, cyber resil- ience is an emergent property of both the agency and the portion of the transportation system it is responsible for shaped by agency mission, objectives, performance goals, and implemen- tation tactics. These business plan elements are in turn constrained by various political, legal, financial, and technical realities all of which are ultimately carried out by a workforce with its own unique set of knowledge, skills, experience, motivation, and culture. Integrating across all these aspects at any point in time provides a specific measure of cyber resilience that needs to be assessed against regulatory compliance, risk appetite, investment priorities, and so forth, to determine leadership’s subsequent response (Figure 2-11). The essential issue is not whether an agency’s computers are cyber resilient but whether the DOT can, even in the face of adversity, keep people and goods moving in a safe, secure, and economical way. Cyber resilience is a pri- mary strategy available to DOTs to ensure this mission. Actions That Improve Cyber Resilience The scope and scale of managing an ever-evolving cyber resilience program are daunting, and it is outside the scope of this discussion to provide the detailed professional or technical guid- ance necessary to establish or improve the cyber resilience capability within a specific DOT. Successful programs mature over time, but the following list of programs and plans highlights core components that are common across many organizations and industries concerned with cyber resilience. Many of these components may already exist within the agency, perhaps under Figure 2-11. Faces of cyber resilience.

Understanding Transportation Resilience: A Cyber Perspective 57   different labels; many will need to be developed jointly with sister agencies, particularly with statewide IT, emergency management, and homeland security or law enforcement organiza- tions, where they exist. The components are: • Continuity of transportation and agency operations plans that include cyber failures; • Crisis communication plans; • A risk-driven critical cyber infrastructure protection program; • A risk-driven critical data protection program; • Information and control system contingency plans; • Cyber incident response and recovery plans; and • A general disaster recovery plan. Even a superficial scan of the DOT against these components will provide valuable insight into the agency’s likely degree of cyber resilience. Organizations lacking these components are, by definition, less resilient than those who have invested in them. In all cases, senior DOT leadership needs to establish and promote core values and skills asso- ciated with resilience in general and cyber resilience in particular. Equally important is the need to develop workflows and business processes that embed and reinforce cyber resilience policies. Some common process elements include: • Determine and communicate the importance of cyber resilience to your organization; • Use peer exchanges, peer benchmarking, or similar methods to understand what “good” cyber resilience looks like; • Determine which systems, applications, networks, technical components, and data are mission-critical, and focus on making those components resilient; • Develop and deploy or improve necessary program elements identified above; • Establish cyber resilience performance measures and targets and provide frequent progress updates; • Establish an agency-wide cyber resilience training program reinforced with the appropriate table-top, functional, and full-scale exercises. Industry experience highlights the absolute necessity of doing these exercises frequently; and • Determine who in your situation is in charge and what your agency’s role is in cyber resilience. Obviously, the programmatic and process recommendations presented in the previous sec- tion represent significant initiatives that will take years to establish and mature. Meanwhile, risks to the DOT continue to increase. What can a state DOT do now when it comes to improving its resiliency against cyber breaches or failures and how can a DOT sustain its operations and protect its cyber assets through major disruptions, regardless of cause? Table  2-7 is adapted from the 2006 National Infrastructure Protection Plan (NIPP) risk management framework, which calls on each infrastructure sector to identify those functions, assets, networks, systems, and people that make up the nation’s critical infrastructure and its key resources. This framework was further developed in the May 2007 CI/KR SSP for NIPP (DHS 2007). This discussion focuses on the “Systems” row while recognizing the interdependencies between all of the rows. From the DOT’s perspective, this definition includes three distinct points of view of the system: planning (long-term), engineering (intermediate-term), and operations (short-term); three strategic levers: policy, people, and programs; with two different focuses: agency and infrastructure; and two different periods of research interest: pre-event (risk reduction) and post-event (consequence reduction). The starting point for any resilience planning is to assume that a cyber incident will occur and will degrade, disable, or destroy not only digital assets but parts of the transportation

58 Transportation System Resilience: Research Roadmap and White Papers infrastructure as well. The various options presented in Table 2-8 provide a menu of strategic choices that can deployed before, during, and after a catastrophic cyber failure. The details of these choices should be documented in various COOP/COG, incident response, emergency response, and other plans, as appropriate. Those DOTs that rely on another state agency for its information technology and commu- nications services have a special duty of care to ensure that the unique needs and priorities of the transportation infrastructure are well understood and reflected in statewide and regional policies and plans. Although these types of resilience-enhancing actions apply to either cyber or physical infra- structures, transportation decision makers should not be lulled into thinking that these areas are the same. Cyber systems are different from physical systems in many important ways that need to be accounted for: • Systems design, security, and resilience require different skills than usually exist in a DOT. Relatively few persons with these skills are attracted to government employment. FUNCTIONS The assignments, tasks, and positions in a state DOT that are critical to the performance of continued transportation service ASSETS The infrastructure, equipment, resources, tools, vehicles, hardware, and facilities owned and operated by a state DOT NETWORKS The relationships maintained by a state DOT with the private sector and other branches of government that ensure continuity of transportation operations The critical technology and applications, including data, used to operate the DOT and the infrastructure and enable reliable network communication PEOPLE The necessary personnel needed by a state DOT to ensure resilient transportation services SYSTEMS Table 2-7. The 2006 NIPP infrastructure framework. Actions Definition Redundancy Reroute communications, data or controls by adding one or more parallel components or subsystems Backup Components Replace one or more components whose function is disrupted Substitution Switch a process from one input or component to another Reduce Vulnerabilities Redesign systems and components to reduce or eliminate their vulnerabilities. Harden, replace or relocate critical system components Improvisation Improvise during a disruptive event, perhaps by re- engineering processes in real time or making do with materials and assets at hand. This could mean returning to older manual processes Prioritization Give systems preferential access to critical or scarce resources; focus on restoring cyber and communication infrastructures first Source: Moteff (2012) Table 2-8. Resilience-enhancing actions.

Understanding Transportation Resilience: A Cyber Perspective 59   • Although the risks—hazards, frequency (i.e., exposure), and consequences—to transporta- tion infrastructure are well known, cyber risks are poorly understood. • Cyber incident reporting over the past 5 years indicate, however, that incidents are becoming more frequent, systems are more vulnerable than previously thought, and the consequences of cyber failure are increasingly more expensive and disruptive. Engaging with Cyber Resilience The need for a more effective set of short-term and long-term cyber resilience strategies is increasingly obvious and urgent, but many political, institutional, scientific, and technical barriers still exist. Finding creative ways to overcome these barriers is a critical challenge for transportation leadership. The following discussion points were derived from common challenges that organizations encounter as they attempt to develop and introduce more formal cyber resilience manage- ment approaches. The questions listed are neither exhaustive nor representative of all agen- cies. Recommendations already exist for addressing some of these questions (see Appendix C); addressing other questions will require new research projects. • Do you know the current and projected cyber risks to your agency and the consequences of the loss of products and services for your system and its users? Do you know how these risks impact travel, safety, environmental quality, and economic activity at community, regional, statewide, or multistate levels? • Have you implemented formal asset management, performance management, supplier manage- ment, and risk management approaches in your agency? Are these functions coordinated with each other? Are they coordinated with your traditional long-range planning, program delivery, and operations functions? • Have you integrated resilience requirements in these management systems? Have you inte- grated cyber resilience requirements into these? • How will you resolve the conflicts between policies, procedures, and priorities of your agency and others such as statewide IT and emergency management? • Do you participate in community and statewide planning initiatives reflecting integrated incident response, disaster recovery, continuity of government, and continuity of operations, including mitigation priorities? • Critical success factors influencing cyber resilience performance include transparent commu- nication, collaborative and cooperative partnerships, and a reservoir of social capital built up between elected officials, agency leaders, key technology providers, and others. Do you know whom you can rely on in a crisis? Do you know who relies on you? • Are you supporting AASHTO, TRB, and ITE cyber resilience initiatives? Are you investing in resilience-focused education and training for your executive staff, your employees, and your business partners? • What will it take for you to personally own this issue? A Scenario: Test for Cyber Resilience Readiness The following scenario is fictional, but it is based on actual events. Time: Some December in the near future. Unbeknownst to the agency, a while ago some perpetrator sent a 4GB USB flash drive, nicely embossed with what appears to be the agency’s logo, to every employee of Fleetwarez,

60 Transportation System Resilience: Research Roadmap and White Papers the agency’s fleet and fuel management software vendor. Appreciative of the “gift,” several unwitting employees immediately started using the flash drives on their work computers. Unfortunately (for the agency), the drives were infected with ransomware, a particularly nasty strain of malware. The ransomware infiltrated the Fleetwarez developer’s network and was subsequently downloaded to every DOT vehicle in your fleet during a regularly scheduled software update. Several days ago, on the eve of the largest snowstorm forecast in years, a disturbing message popped up on the in-vehicle display in all of the agency’s plows, roadside assistance trucks, and maintenance vehicles—none of which will start (Figure 2-12). The governor and the media have heard rumors, and both are pressuring the agency for a situation report. Meanwhile, the snow has begun to pile up. What do you do now? Seriously, what would you do? Figure 2-12. Example ransomware pop-up screen.