- Home
- Report n°3: Financial protection of critical infrastructure
Report n°3: Financial protection of critical infrastructure
Interdependent risks
Terrorism generates several levels of interdependency.
Disincentive to invest in protection
First, the risk incurred by an individual, a company, or even a country does not depend entirely on its own decisions to invest in security. The actions of other agents enter into the equation. There is a non negligible possibility of being affected by a terrorist attack because others have not taken the necessary security steps. In a global system, if the weak link fails, this can have an impact on the whole system, independently of any protective measures taken by each of the other links. In the case of events on September 11, ineffective security at Boston airport (where the terrorists embarked) led to thousands of victims in the WTC Towers in New York, in the Pentagon, and in Pennsylvania.
Insurance mechanisms in the present configuration are not ideally suited to deal with such interdependencies. In this case it is extremely difficult to connect the price of coverage and prevention efforts since these efforts may be only marginally useful if other agents - on which the insured persons depend - are not sufficiently protected and if insurers do not have much of a hold on them. Unless one were to propose an approach of the insurance monopoly variety, in which case it is possible to endogenize externalities (a single insurer covering all agents, and therefore all risks, direct and interdependent both), private insurance has limited power to encourage prevention and determine a price for coverage which reflects the actual exposure of policy holders (Kunreuther et Michel-Kerjan, to be published).
Negative externalities of protection measures
Contrary to other major risks such as industrial or natural disasters for which individual or corporate investment into protective measures has the effect of reducing the occurrence of the event and/or the level of potential loss, protective measures against the risk of terrorism do not come easily.
In effect, any local self-protecting measure may also generate negative externalities. For example, to set up in an airport publicly observable protective procedures may well reduce the likelihood of an attack against that airport since the marginal benefit of such an attack, from the point of view of the terrorist group, decreases because of the limited resources effect. Nevertheless, this may encourage terrorists to attack other more vulnerable targets(23). As a result, self-protection of one agent may increase the danger of attack for other agents(24).
The social benefit obtained through this protection effort may then turn out to be much smaller than the private benefit obtained by the owner of the first airport. It is only by global risk management that such effects can be contained by internalizing externalities. In the absence of decentralized coordination mechanisms, there is a need for government intervention in order to achieve this (setting up security standards for example).
Crisis management decision externalities
The issue of interdependence is also fundamental as regards crisis management problems in the event of attacks. Proper management of an event must be conducive to reducing damage to people and property. In so doing, it may also happen that decisions taken - at a given time and in a given place, in the frequently highly confused situation that presides over such events and a high degree of uncertainty - may affect other agents besides direct victims and may even be the cause of significant loss by a domino effect. An important limitation of insurance, precisely, is that ordinarily it only covers the direct effects of an event; in other words, the insured person must be the direct victim of the attack.
On the morning of September 11, 2001, when the number of highjacked aircraft was unknown, the American agency controlling aviation (FAA, Federal Aviation Administration) was obliged to ground all commercial flights in the whole of the United States. In March 2004, the City of Chicago lost its case for insurance compensation; the city was suing its insurance company for reimbursement of business losses sustained as a result of the FAA's decision to ban flights. The court decided that the clause in the insurance contract was specific enough, "only covering direct result of a peril not excluded", and this excluded any interdependence effect due to crisis management decisions in New York and Washington (U.S. District Court, 2004).
(23) In some cases, terrorist may want to strike at targets considered to be particularly safe just to show off their capacity to attack; for example governmental or symbolic targets, as was the case on 9/11 against the twin WTC towers and the Pentagon.
(24) In fact, such externalities due to self-protection efforts may also influence the price of insurance for other agents.