Something has changed

When Iceland's most senior leaders speak frankly to the public about how the
country is no longer in a low-tension area, that hybrid threats against it are multiplying, and that its infrastructure – especially its undersea infrastructure – is exposed, it is clear that something has changed.

The country's location, which once gave a sense of distance and shelter, no longer does. Iceland depends on imports of food, medicines, fuel and equipment to operate and maintain its critical infrastructure. Nearly all communications with other countries pass through four submarine cables that are impossible to defend.

A changed threat assessment

The government's analysis of the limits of the country's preparedness calls for a concerted effort to remedy them. Iceland already works closely with the other Nordic countries to strengthen preparedness against cyber threats and to reinforce supply chains. Although the sharing of classified information and analysis within this cooperation is strong, joint
defence capability is still taking shape. This position, of being dependent on alliances and cooperation and
only partly prepared, is one of the two guiding themes of Iceland's new security and defence policy. The other is what must be done: strengthening alliances, preparedness and
resilience.

The draft of the new policy describes the changes in the government's threat assessment. The impact of Russia's unconventional warfare in Europe, persistent cyber attacks by foreign states and growing pressure on the continent's infrastructure show how dependent Iceland is on digital connections with the outside world, on infrastructure at home and abroad, and on solid alliances with other states.

It is positive that the government has shared this initial threat assessment with the public, thereby strengthening understanding of the challenges Iceland faces. A more detailed threat assessment is expected to be ready shortly. It matters that the government stays on this path, shows transparency and publishes the updated assessment openly.

Companies on the front line

Iceland's connections with the outside world illustrate the challenges well. The country depends on
four submarine cables linking it to Europe and North America. Although it is acknowledged that these infrastructures cannot be fully protected against natural hazards or sabotage, Iceland's preparedness and contingency plans for disruptions to them inspire only partial confidence, and the country is exposed to prolonged disruptions.

The policy therefore calls on society as a whole to join forces to strengthen its own resilience. Companies, private and public, as well as civil-society organisations, are thus not service providers but key actors in Iceland's security and defence. They own and operate airports, ports, energy systems, water utilities and digital infrastructure. The hybrid threats and attacks facing Iceland today are therefore directed first and foremost at them; they are on the front line when the country's infrastructure must be defended.

A step further

To strengthen its cooperation with companies and civil-society organisations, the government can build on
Iceland's deep-rooted culture of civil protection, embodied in the work of the search-and-rescue teams and the Red Cross and shaped by decades of experience of volcanic eruptions, storms and other natural disasters.

The government is working to strengthen CERT-IS so that the agency can conduct active
real-time monitoring. That work rests on cooperation and trust between technology officers in the public
sector and in companies. This can be built upon by establishing a joint security and monitoring centre, operated jointly by the government and companies. It would monitor critical infrastructure in real time, from energy systems and airports to ports and submarine cables, and would also serve as a venue for coordinated exercises to strengthen Iceland's preparedness.

Foresight and clarity

As a state without armed forces, Iceland relies on sound preparedness and foresight.
The National Security Council has a legal duty to assess regularly the state and outlook of security and defence. This role can be strengthened through a joint forum of government, municipalities and business, modelled on Nordic and British practice, a so-called Futures and Foresight Programme. The aim is to monitor systematically the evolution of the security environment, strengthen communication between public bodies and the private sector, identify risks, develop scenarios, exercise responses, and turn analysis into action.

In addition, the government needs to amend the legal framework for security and defence in line with
the new threat assessment. That entails defining what counts as critical infrastructure, imposing
clear obligations on operators, and introducing legislation on the screening of foreign investment. The
other Nordic countries have already tightened rules on investment in the energy sector, telecommunications and port facilities. If Iceland falls further behind, the country risks becoming the weakest link and the easiest point of entry into the region.

From words to action

Iceland's security environment is now more hostile than it has been since the end of the Cold
War, and the country depends on few and increasingly vulnerable infrastructures. On the other hand, the country has good allies, has now set out a policy, and its society is used to dealing with risk and uncertainty.

The main challenge for the Icelandic government is not to formulate policy but to prioritise and implement. Over the next twelve months, the government should set itself five or fewer clear priorities and give the National Security Council responsibility for follow-up. The frank statements of Icelandic leaders about dangers and threats also require that the public has a clear picture of how the government is faring in meeting them.

In the end, the government's success will be measured not by the words of a policy but by how well it manages to bring together the public administration, business and society as a whole to protect the country's infrastructure, data and supply chains – and thereby all Icelanders.

Charlie Edwards is a defence and security expert at the International Institute for Strategic Studies and conducted an independent analysis of Iceland's security and defence policy at Varða's request. The article first appeared in Morgunblaðið on Wednesday 10 December.