2.1 Introduction

This section first explains the concept of ‘societal disruption’ to clarify what type of events we are addressing in this report. If events have a significant digital component, we speak of ‘digital disruption’. Because societal disruption in policy practice is often linked to national security and ‘critical assets’, we also consider the classification of critical processes and critical infrastructure.

2.2 Societal Disruption

As societal disruption follows catastrophic events such as major floods or pandemics like Covid-19, it is intricately linked to the concept of risk. Risk is often defined in the literature as ‘probability x consequence’.Footnote 1 Societal disruption concerns the consequences of that risk: the risk that damage will actually occur. While policy documents often refer to ‘societal disruption’, there is no clear definition of the term. Clearly, a major disaster would disrupt society. But it is more difficult to define a clear threshold as different types of events will differentially disrupt society, the market and government. Nor does disruption have to start at a clearly defined point. Like a smouldering peat fire, disruption may begin under the surface, its full extent only becoming apparent later. We explain the meaning and scope of the concept of societal disruption below by discussing: (1) ‘normal’ societal functioning; (2) the severity of disruption; (3) the role of perception; and (4) the duration of disruption.

2.2.1 A Disruption of Everyday Life

Societal disruption implies the disruption of everyday societal processes. By ‘everyday societal processes’, we mean the regular functioning of the institutions of government, society and the market. If everyday societal processes can no longer function adequately – whether due to additional costs or inadequate public confidence – this counts as serious disruption, with consequences for society, economy and government, including justice, elections and the legislative process. We discuss the ‘normal functioning’ of society’s institutions both in terms of verifiable damage to the continuity of society and people’s perceptions of disruption.Footnote 2

2.2.2 ‘Serious’ Disruption: Failure of Core Processes

In the event of serious disruption, societal processes such as payments, the internet, public transport, healthcare, drinking water and electricity may stop functioning or switch to a less efficient mode. The continuity of society would no longer be guaranteed. Long traffic jams or queues could form, large quantities of goods could pile up, information and services could become inaccessible or unreliable, so that many everyday activities would no longer be possible. At this point, disruption would also lead to major economic damage. It may be direct damage, such as to flood defences, homes, computers and company installations, but also indirect damage due to business failures or the disruption of the activities of third parties. Finally, there may be physical casualties: human injuries and deaths.

2.2.3 Perceived Disruption

All of this can, in principle, be verified and quantified, and expressed in financial terms for compensation purposes, for instance. But alongside the material effects, there is also the risk that citizens lose confidence in the institutions of government, the market economy, or the society in which they live. Would they experience the disruption as an inconvenience or as a serious violation of their daily lives? The answer depends on people’s value systemsFootnote 3 as well as the extent of their self-relianceFootnote 4 during and after the disruption.

How people perceive the competence of private and public organizations, particularly that of the government, matters greatly. Did the government take adequate preventive measures? Was it able to take swift action to restore the normal functioning of society? If citizens, companies or organizations feel they can no longer rely on the continuity of normal societal functions, the foundations of the democratic constitutional state may be undermined. What makes digitization particularly problematic is the blurring of geographical boundaries; it may not always be in the power of national governments to quickly restore the normal functioning of society.Footnote 5

The rule of law – which provides fundamental certainty in our society – is based on the premise that we live in a nation-state that can legitimately exercise a monopoly of violence within a clearly defined territory. If this principle is undermined, for example because the state can no longer successfully claim this monopoly, people may lose faith in society and the rule of law. In the event of serious digital disruption, it would also be unclear which resources the state can call on.Footnote 6 Such considerations would inevitably exacerbate the public perception of disruption.

Whether we are talking about an interruption to social services, economic damage, the number of victims, or the loss of confidence in society and government, these must reach a certain scale to merit the use of the term ‘societal disruption’.

2.2.4 Duration of Disruption

A gradual, possibly unnoticed series of minor disruptions may have the same cumulative effect as an event that explodes onto our consciousness. In the former, the consequences of an event remain under the radar and only become clear gradually. The steady spread of disinformation, for example, undermines public confidence in institutions, which can harm the functioning of society over the long term. In the latter, cause and effect are largely indistinguishable; the seriousness of the situation is immediately obvious.

The passage of time is an important factor in the costs of disruption. Longer disruptions mean higher costs.Footnote 7 Ultimately, the adverse consequences of an event and assessments of damage will unfold over time.Footnote 8 More broadly, this also applies to the reputation of companies, organizations and governments. Inadequate detection systems and sluggish responses will impact the public’s confidence in government, which by definition is expected to respond to serious situations swiftly and effectively.

2.3 Critical Infrastructure and Critical Processes

Governments often view societal disruption through the lenses of national security and critical infrastructure. For the Dutch government, national security encompasses various ‘critical’ interests: territorial integrity, economic security, ecological security, physical security and social and political stability. The definition of national security has recently been extended to include ‘other situations that (may) have a major impact on society’.Footnote 9 These include ‘critical’ processes that are so crucial that their failure or disruption would lead to immediate societal disruption or undermine national security. Together, these processes form the Netherlands’ ‘critical infrastructure’.Footnote 10

Critical infrastructure denotes a range of services upon which society depends. Critical infrastructure must be protected from natural and technological disasters (e.g. floods and nuclear accidents). More recent understandings of critical infrastructure, however, transcend the traditional focus on national defence and military considerations. The focus of security policy has expanded beyond hostile actors, their capacity and motivations, to include the general vulnerabilities of society as a whole. Underlying this broader definition is the more diffuse spectrum of threats since the end of the Cold War, and new societal vulnerabilities due to our dependence on information systems.Footnote 11

2.3.1 Critical Processes

The broader definition of critical infrastructure has led to a different approach to risk. In the absence of reliable data on the likelihood and impact of the risks society now faces, the focus has shifted from the potential causes to the potential consequences of the failure of processes critical to society’s functioning. A classification of critical processes provides guidance for politicians, policymakers and other stakeholders to determine whether a particular situation should be considered serious – and thus whether the government should take action and, if so, how. After all, it is impossible to protect all societal functions against every possible threat all of the time, and we need to distinguish critical from non-critical processes. Assessments by the Dutch government have quantified the consequences of failure of each process as it bears on potential economic, physical and social harm. Consideration of cascade effects resulted in two categories of critical processes, based on the seriousness of the impact of their failure.

The ‘critical’ nature of societal processes also depends on their organization and the risk of disruption.Footnote 12 This includes the presence of back-up options and recovery time – decisive factors for the extent of damage or the number of victims if things go wrong. Impact is not a fixed measure; it depends on the resilience of the actors responsible for the critical process in question.

Overviews of critical processes therefore differ, both over time and from country to country. Governments compile different lists or add new areas to reflect the latest threats. In 2017, the United States reclassified elections infrastructure as critical.Footnote 13 Germany includes the media and certain cultural goods.Footnote 14 While healthcare regularly features in international overviews of critical infrastructure, Dutch hospitals and other healthcare institutions have recently been dropped from the list.Footnote 15 As in the DigiNotar case, the critical importance of certain processes often only becomes clear after they suffer disruption. We will return to the implications of these national differences in the next section.

2.4 Digital Disruption

Digitization means that societal functions and processes are vulnerable in new and unexpected ways. This vulnerability applies to both regular processes and processes classified as critical by the government, since most critical processes are already bound up with digital infrastructure. By ‘digital infrastructure’, we mean all facilities for the storage, exchange and processing of digital data. Until about 10 years ago, the risk of the disruption or failure of these facilities was absent from almost all national and international risk analyses. This has changed over the past decade. The risk of the disruption or failure of digital infrastructure has risen rapidly through the ranking of risks that would have disruptive consequences for society.Footnote 16

The disruption or failure of digital infrastructure can have many causes, from accidental (errors) or deliberate human actions (often of a criminal or at least unlawful nature) to the spontaneous failure of systems or the semi-autonomous behaviour of machines. There are also more indirect causes such as fires, power failures or floods that damage servers. These causes can occur separately or in combination and can result in both acute and gradual disruption. Where societal disruption has an important digital component, we refer to ‘digital disruption’.

The scope of this report does not extend to the exact likelihood and consequences of digital disruption. Recent studies have already addressed these questions, both in the NetherlandsFootnote 17 and abroad.Footnote 18 The potential of digital disruption leading to significant economic damage and social unrest is real, and is the premise of our analysis in the following sections. Our aim is to formulate an agenda for measures that could be taken to prepare society for such disruption, focusing specifically on what government can do.

2.5 Conclusion

We use the term ‘societal disruption’ to refer to serious disruptions to the regular functioning of society. What constitutes ‘regular’ societal functioning and ‘serious’ disruption will depend not only on the interruption of core processes in society but on the confidence that citizens, companies and public and private organizations have in them. The two feed into one another: a major disruptive event will inevitably undermine public confidence in society as well. At the same time, a series of smaller events may exacerbate the sense of threat and undermine confidence in the government, even if the event’s actual significance is limited.

By identifying critical processes, the government seeks to set priorities and ensure that not all disruptions are classified as ‘major’. This helps to direct scarce resources to where they can be used most effectively and legitimately. The list of critical processes is the result of an assessment of their importance and vulnerability to disruption and failure. That the disruption and failure of digital infrastructure can also have socially disruptive effects is now widely recognized. In the following sections, we use the concept of digital disruption to describe these effects.