Could Uber be deemed critical infrastructure?

The president’s cybersecurity commission is weighing changes to the way the U.S. government defines which industries are vital to the life of the nation — a move with potentially enormous legal and financial impact on the business sectors involved.  

“How we define critical infrastructure is going to have to evolve with technology, with innovation,” said Kiersten Todt, the executive director of the President’s Commission on Enhancing National Cybersecurity at the Billington Cybersecurity Summit in Washington.

She pointed to how “technologies that were developed as fun have now become part of our critical infrastructure,” citing Facebook and Uber as examples of companies that now provide critical services.

The designation of 16 U.S. industrial sectors as critical infrastructure dates back to the Clinton administration. The 16 sectors range from banking and financial services, through transit, telecommunications and retail, to water and sewage. In most sectors they encompass a wide range of differently sized companies — from multi-national giants to tiny mom-and-pop operations.

“That was our best guess at what was critical infrastructure,” retired Coast Guard Commandant Adm. Thad Allen told the summit Tuesday about the existing taxonomy. “It’s been around for several years and I think we have to revisit that because of the ubiquity of the internet and [its] interconnectedness,” he added. “We have to figure out a new way to approach it.” 

In a recent interview with FedScoop, Todt called the definition of critical infrastructure “a very interesting question.”

In such an interconnected economy, “Where are those lines,” between critical infrastructure and other sectors? “You can’t have everything be critical infrastructure,” she noted. 

Many critical sectors are regulated (think banking, telecoms and the power grid) and  — although few  specific regulatory provisions apply to critical infrastructure per se — the perception of business toward such a designation is generally not positive.

Todt joked that Uber and other technology companies had recoiled at the suggestion that they might be considered vital. 

“They were telling us: ‘Please don’t label me as critical infrastructure,'” she said.

Nonetheless, the commission is looking at whether definitions needed to be updated, given the interconnected and inter-reliant character of the modern economy.

“It’s about the supply chain,” she said. “How you define critical infrastructure doesn’t have to do with size, doesn’t have to do with location, it’s really about what is the function and how does that feed into the services that are provided to a community,” she said.

“We don’t have an answer right now,” she said of the commission.