CYBERATTACKS MAY INCREASE THE RISK TO THE RESILIENCE OF CRITICAL MINERAL INFRASTRUCTURE

The Energy Act of 2020 defines a “critical mineral” as a non-fuel mineral or mineral material essential to the economic or national security of the U.S. and which has a supply chain vulnerable to disruption. Critical minerals are also characterized as serving an essential function in the manufacturing of a product, the absence of which would have significant consequences for the economy or national security.

Current research deals with cybersecurity concerns related to the resilience of critical mineral infrastructure. As with the increased use of ICS (Industrial Control Systems) in other industries, the use of automation and greater connectivity in the mining industry and metal manufacturing increases the risk to the resilience of critical mineral infrastructure by increasing the attack surface available. Several motives for cyberattacks will be highlighted. Given the importance of critical minerals in the supply chain of many products, cyberattacks can be motivated by an intent to harm public or private interests further down the supply chain. Information stolen from mining records can be monetized by attackers. Espionage for competitive advantage through attaining industry secrets may occur.

Finally, APTs (Advanced Persistent Threats) may be of increased significance to these industries given geopolitical concerns over the control of critical mineral markets. Of particular interest is the possibility that short-term damage may be used to diminish the perception of investor trust while presenting foreign companies as more trustworthy stewards of the global market. It must be remembered that failure to manage cyber risk strategically can affect more than the actual intrusion, as investigations have to be done which may require temporary shutdowns of other equipment.

Given current policy goals of greater independence and supply chain resilience for critical minerals, along with ethical and environmental targets, a consistent presence of cybersecurity standards in these industries may be one useful means of reducing risk.