Discussion

Over the last several decades, increased energy usage has been seen globally, with increases in both access and consumption. ^{Reference Ritchie, Roser and Energy7} Lee pointed out that although attacks on energy infrastructure are a small percentage of total attacks at this time, they are of interest to some terrorists based on their motivation. For terrorists whose motivation is related to economics or climate, infrastructure targets such as energy facilities are attractive as destruction of these targets may have economic impacts. They also point out that energy facilities are vulnerable due to their low mobility and high concentration based on resources needed; for example, oil facilities are often concentrated around locations where oil is naturally found. Nigeria, a country with some of the highest number of attacks on oil infrastructure, has many groups with these motivations. Groups point to oil production causing environmental devastation and poor compensation for communities effected in the Niger Delta as motivations for attack. ^{Reference Tobor8,Reference Ugwueze and Onuoha9} Facilities in remote locations may be more difficult to protect. ^{Reference Lee10} This was pertinent in 2019 when drones were used to target Saudi Arabia’s Aramco Facility causing the largest disruption of oil production on record. ^{Reference Hubbard, Karasz and Reed11}

Health care systems can look to previous incidents of large-scale “blackouts” to understand potential impacts. In 2003, a tree branch fell onto high-voltage power lines leading to the largest power outage in North American history, affecting an estimated 50 million people. ^{Reference The12} This wide-spread power failure led to an increased number of patients presenting to New York City hospitals due to medical device failure, ^{Reference Greenwald, Rutherford, Green and Giglio13,Reference Prezant, Clair and Belyaev14} respiratory disease, ^{Reference Dominianni, Lane, Johnson, Ito and Matte15} and injuries that were attributed to the blackout. ^{Reference Beatty, Phelps, Rohner and Weisfuse16} The New York City Department of Health and Mental Hygiene reported multiple hospital generator failures, issues with equipment sterilization, the release of 500 million gallons of untreated sewage into local waterways, and the loss of mechanization of syndrome surveillance mechanisms. ^{Reference Beatty, Phelps, Rohner and Weisfuse16} The power outage itself affected the population’s health when compared to data from comparable weather. ^{Reference Lin, Richardson, Hilborn, Weinberg, Engel and Wade17} For example, syndromic surveillance demonstrated an increase in diarrheal illness in the days that followed. ^{Reference Marx, Rodriguez and Greenko18}

The impacts of power failure due to natural disaster or equipment failure could be seen with power failure due to intentional attack. Regarding attacks on power infrastructure, four of the top ten affected countries are in South and Central America. All are in the top five, with El Salvador having the highest number of attacks at 1,061, followed by Colombia with 821, Peru with 653, and Chile with 456. Pakistan is the only country in the top of the list outside of this region. In all four South and Central America countries, attacks on electricity infrastructure are the most common.

The United States has seen an increase of attacks on the power grid in 2022 and 2023. ^{Reference Levenson19} The Program on Extremism from George Washington University (Washington, DC USA) has noted that the energy infrastructure is of interest to violent extremist groups in the United States. ^{Reference Krill and Mayhem20}

Water is a crucial resource, from drinking water to power and industrial functions, making it a target with a long history of attempted and successful attacks. These attacks can be to impede the system of delivery or to contaminate the contents. ^{Reference Gleick21} There are a number of points where contaminants, including bioweapons, can be introduced, starting upstream from collection points. ^{Reference Meinhardt22} Water systems increasingly rely on complex systems and smart technology making them vulnerable to cyber threats as well as disruptions in power. ^{Reference Bello, Jahan, Farid and Ahamed23,Reference Thornton24} One group looked at attacks on water infrastructure, particularly dam projects in Afghanistan, India, and Pakistan. They found in all three countries, there are water infrastructure projects that have faced scrutiny by local groups due to mistrust in the government or concern that the project is used to further domestic or foreign policy agenda. ^{Reference Ashraf, Dinar and Dams25} These three countries are all in the top ten for attacks on water infrastructure. Pakistan was recorded to have 20 events. Afghanistan and India were found to have 11 events each. Groups reviewing naturally occurring and accidental waterborne outbreaks have highlighted this area of vulnerability for terrorists. ^{Reference Khan, Swerdlow and Juranek26} Clean water is a cornerstone of sanitation, hydration, and the mixing of medications, as well as other functions within the health care setting. Lack of access to clean water in hospitals of low- and middle-income countries has been shown to negatively impact surgical care. ^{Reference Chawla, Gupta, Onchiri, Habermann, Kushner and Stewart27}

Contamination of water can have long-term impacts on the health and well-being of a community. In 2014, the water system in Flint, Michigan (USA) switched sources. During this change, the system was not treated to prevent the corrosion of pipes, leading to increased levels of lead in water provided to the community. ^{Reference Ruckart, Ettinger, Hanna-Attisha, Jones, Davis and Breysse28} In 2016, this was found to correlate with, and likely cause an increase in, the percentage of estimated blood lead levels in children. ^{Reference Hanna-Attisha, Lachance, Sadler and Champney Schnepp29} The Flint Registry has enrolled potentially exposed members of the community and monitors health and childhood development. ^{Reference Ruckart, Ettinger, Hanna-Attisha, Jones, Davis and Breysse28} In addition to the direct medical effects of wide-spread water contamination, there are potentially secondary effects. A survey of Flint residents from 2019-2020 showed a high prevalence of presumptive depression and posttraumatic stress disorder (PTSD). ^{Reference Reuben, Moreland and Abdalla30} A clean, reliable source of water not only impacts the health of a population, it can potentially affect the operations of a health care system. In August of 2022, heavy rainfall flooded the aging water treatment plan in Jackson, Mississippi (USA). The damage caused by flooding caused pumps to fail and water to stop flowing into the city’s pipes. ^{Reference Breslow31} This lack of water impacted the ability of some hospitals’ fire suppression systems, resulting in a fire watch. ^{Reference Bean32,33} Other facilities had their air conditioning systems affected or had to provide portable bathrooms for staff, visitors, and patients. ^{33,Reference Vera, Hanna and Jackson34} Some local facilities were unaffected, as they had created their own water resource by constructing wells in response to previous water supply cut offs. ^{Reference Reily35}

Armed conflict has shown how attacks on CI affect health care. Within the first 162 days of the war in Ukraine, 15 cities had disruptions of electricity and eight had disruption of their water supply. ^{Reference Haque, Naeem and Wang36} In response, UNICEF delivered water and generators to hospitals in Karkheive, Ukraine to counteract interruption of services. ² During the conflict in Syria, the Islamic State of Iraq and Syria (ISIS) deliberately contaminated water with crude oil. ^{Reference Abbara, Zakieh and Rayes37} In fact, in 2016, it was estimated that 50% of the country was damaged in the conflict, partly due to intentional attacks on water infrastructure as well as power supply needed. ^{Reference Vidal38}

Loss of telephone service in a hospital can affect how staff are alerted to emergencies, how clinical teams formulate and carry out treatment plans, and how they reach out to patient families for important decisions. In much of the world where prehospital emergency care is available, help is summoned by telephone. Interruption of such service may delay the public’s ability to access care. In 2019, CenturyLink (Monroe, Louisiana USA), which provides service to several United States emergency call centers, experienced an outage. This impacted the emergency services in a large geographic area where the public could not reach the 9-1-1 emergency system to call for help. ^{Reference Cimpanu39} The use of internet-based technology in some emergency call systems may improve response, but this also creates a new vulnerability in the form of a cyberattack. ^{Reference Goebel, Dameff and Tully40}

Proliferation of EMRs, telehealth capabilities, and network-based equipment have increased efficiency and improved health care delivery. ^{Reference Kelly, Campbell, Gong and Scuffham41} However, increasing dependency on these tools makes the systems which rely upon them more vulnerable to disruption. The global connectedness via the internet has presented an entirely new target to those seeking to attack infrastructure. While kinetic attacks such as the 2022 targeting of land and subsea cables in and around France remain a serious threat, ^{Reference Burgess42} the utilization of cyberattacks by violent non-state-based organizations has taken on a distinct similarity to hybrid-warfare. ^{Reference Granholm, Tin and Ciottone43} While there is currently debate on whether ideologically motivated cybercrime rises to the level of cyberterrorism, the United States Department of Homeland Security (Washington, DC USA) has predicted the use of cyberattacks as a likely methodology of terrorist activity. ^{Reference Holt, Lee and Freilich44} The attractiveness of targeting CI by nefarious actors via cyberattacks is of particular concern, and several recent accounts have highlighted the vulnerabilities of CI to cyberattacks.

Health care is particularly vulnerable to cyberattacks and is one of the most frequently targeted and costly entities, with an average total cost of US$10.1 million per breach in the United States. ^{Reference Lis and Mendel45} The proliferation of EMRs, telehealth capabilities, and network-based equipment have increased efficiency and improved health care delivery. ^{Reference Kelly, Campbell, Gong and Scuffham41} However, increasing dependency on these systems makes them more vulnerable to disruption via cyberattacks. One study reported an increase in medication errors during EMR downtime. ^{Reference Hanuscak, Szeinbach, Seoane-Vazquez, Reichert and McCluskey46} After the 2010 Chilean earthquake, many hospitals were able to maintain electrical systems due to backup generators. However, they did not have a redundant communications system. Kirsh, et al reported that this breakdown in communications created “enormous difficulties in coordinating aid and for requesting outside help.” ^{Reference Kirsch, Mitrani-Reiser and Bissell47}

Further research is needed to fully understand the potential impact of these events. Deeper evaluation of direct and indirect impacts to local health systems for attacks found in the GTD should be considered to fully understand impact these events have.

As health care systems and facilities conduct hazard vulnerability analysis, attention should be paid to understanding the interconnected complexities of the resources needed to support such systems. Facilities in locations where attacks on utilities are more prevalent need to look at how their institutions can continue to function when supply is cut, particularly in the case of a long-term interruption of service, and hospital systems should prophylactically engage with Disaster Medicine specialists who are specifically trained to understand and operate in complex crisis environments. Understanding the health care impacts of intentional attacks such as terrorism events is the subspecialty domain of Counter-Terrorism Medicine (CTM), a niche yet increasingly important area of study and discussion as the modern environment of threat rapidly evolves. Hospital systems should incorporate mitigation strategies to prevent the loss of services when CI is interrupted. Development of emergency operations and “downtime” plans should be prioritized, simulation drills of critical infrastructure failure drills should be performed, and multi-agency discussions with other key stakeholders regarding potential failures should take place, especially if they are in a region of potential risk to such attacks.