The security of CIs requires not only the effective assessment and management of threats and risks and proven reliability,4Measuring the security of CIs is an extraordinary complex task. However, various measures for assessing it have been developed, such as approved CI protection plans, audit of CI protection status, structural and budgetary changes, and exercises (Piekarski and Wojtasik, 2022).⁴ but also public trust in that reliability; the dependence of everyday activities on CI systems indicates and requires trust and certainty (Critical Five, 2014). The interpretation frameworks through which certainty assessments are made and trust maintained reflect the way threats are perceived, prepared for and managed.

Increased connections and the formation of dependencies within CIs are essential features that reflect the level of modern societies’ development. However, the critical elements of the systems need to be protected, and external interference with the processes must be prevented—in terms of target hardening, for instance—to ensure the continuity of the respective operations, and also in exceptional times (Bennett, 2018; Botha, 2020; Kahan, 2017; Wang et al., 2013; Wiśniewski, 2016). Such a solidification of protection is a way of making systems more robust and less susceptible to interference and harm (Aradau, 2010). However, it is concurrently a method for blackboxing CI systems in a way that supports their main functional objectives and draws attention to their essential aspects. That is, they encapsulate not only in a technical sense but also in terms of knowledge production (Moore et al., 2019). But what does this capsulation mean more specifically?

In modern societies, CIs consist of sheltered systems of this type, together with connections and dependencies between them. Due to such complexity, even if an individual function or process can be sheltered and controlled, this capacity is unavailable at the system level; security, reliability and the related knowledge within separate systems do not translate into a broader system-level capacity (Hempel et al., 2018). Despite this, CIs must deliver on their promise of certainty and prove their ability to provide for security. But how does the mechanism behind this ‘providing for security’ work? In other words, how is blackboxing conducted so that CIs present themselves as systems performing their functions in a fool-proof manner?

As socio-technological systems, CIs rely on a concept of rationality that is linked to technical and engineering expertise, with their characteristic action ideals (Delanty and Harris, 2021; Mitcham, 2015; see also Schön, 1983). As technical rationality aims to produce order and control capacity through data classification and calculation (Gunderson et al., 2018), the provision for security builds on the concepts of risks and threats identified from previous events, as well as their management mechanisms, criticality and vulnerability analysis, and scenario models, among others (Chen et al., 2019; Reniers and Audenaert, 2014; Wang et al., 2013; Zio, 2016). Technical rationality brings efficiency to interpreting reality and turning what has been learned from previous events into better capability. It seldom expresses its selectivity, but instead represents itself as the only reasonable indicator of reality and provider of solutions, as is typical for black boxes.

Technical rationality recognises errors and imperfection as part of activity, so errors made and deficiencies identified can be turned into an ability to close gaps in security, learn from failures and strengthen management capacity (Gómez, 2015). The internal logic of technical rationality determines what stands out as an error, an imperfect performance or a gap in security. The very idea that this logic could be defective or even harmful is absurd. It is impossible to scrutinise analytically within itself. Systems learn in a way that represents a stronger capacity to address an increasingly diverse range of security threats and an enhanced capability to manage them effectively. It builds trust in the capability of expertise to face uncertainty (Bieder, 2017; Runciman, 2006). In this way, technical rationality can ensure that the CIs are always the best possible ones considering the given situation, and that they are capable of evolving towards the next best possible condition.

Another key characteristic of technical rationality is its tendency to interpret reality as being composed of technical challenges calling for technical responses—since a black box is filled with technical content, engineering expertise represents the most advanced interpretation of the security of CIs (Gunderson et al., 2018). It defines the most essential problems in the security environment, formulates them, and opens the vista to solutions deemed adequate, justified and sufficient (Hubbard, 2009). It is legitimised as the correct, commonly approved knowledge method (Aradau and van Munster 2011), which increases the distance between professionals and laypeople such as the ordinary users of infrastructure services, as it becomes increasingly sophisticated and strengthens its position (Gómez, 2015). Laypeople are expected to trust and believe that the security of the systems is in expert hands (Rodríguez, 2015).

However, it is worth asking whether these expert hands are tied to established habits of thinking (Aven and Guikema, 2011), and hence have become an instrument for solving the problems tailored to it more and more precisely and subtly. That is, on what basis can the capacity to design, operate and manage well-defined technical problems be extended to apply for providing for security to CIs on a larger scale? Such a question usually remains unasked, as the basic assumption regarding technical rationality standardises, moves aside from criticism, and thus allows argumentation and operation to be built on these assumptions (Mitcham, 2015). Paraphrasing Goldman (2018), it can be said that technical rationality gives an impression of the creation of security in a value-neutral, evidence-based manner, which is why it elicits trust and undermines sceptical arguments. However, why technical rationality is considered competent for determining the CIs’ security environment, and what knowledge is being excluded or ignored by its interpretation framework, remains unexplored. Such taken-for-granted gaps provide for potential security hazards. Therefore, it is important to approach them as possible means and mediums intelligent terrorism could utilise by weaponising them.

The unambiguous definition of the concept of terrorism has proved to be exceptionally challenging (Feyyaz, 2019), yet attempts to define it precisely may also have hampered the grip of the phenomenon comprehensively (Ramsay, 2015). Despite the lack of consensus, the general features of terrorism include the desire to cause feelings of terror and insecurity through violence or the threat of violence within a group larger than the actual target of the very attacks (Horgan, 2005; Richards, 2014). According to Richards (2014), ‘terrorism is best conceptualised as a particular method of political violence’, which can be interpreted so that the very meaning of terrorism cannot be reduced to the immediate impacts of a limited attack, but the real impacts arise from the fundamental values, structures and assumptions terrorism threatens (e.g., Enders and Sandler, 2012). In other words, the core of the dynamics of terrorism consists of how terrorist activity is interpreted in the target society, and how these interpretations affect people’s sense of security. By attacking a piece of critical infrastructure, as Bennett (2018) argues, terrorists may disrupt the standard of living and cause significant physical, psychological and financial damage. However, another question is how an attack would shake the joints of black boxes and undermine trust in CIs and their management in general.

Although CIs have been targets of terrorist attacks in recent history (on statistical analysis of this theme, see e.g. Miller, 2016), the extent to which they have succeeded in causing the long-term impacts in the larger scales is highly questionable (Abrahams and Gottfried, 2014; see also Muro, 2019). Roughly speaking, the CI systems have so far proved their ability to return to normal operation quickly after the attacks, and communities have regained their trust in the security of the systems. It seems that the attacks have generally failed to communicate in ways that would profoundly undermine people’s trust in the technical systems and structures that underpin and maintain their daily lives. The acts have not disrupted the social fabric of societies by instilling distrust between people or caused them to question the basic assumptions on which everyday activities are built (Maras, 2013; see also Muro, 2019). In other words, people have sustained their sense that experts and administrations are capable of identifying and managing the respective threats as well as organising effective responses to attacks (cf., Van Der Does et al., 2019). The knowledge strategy for maintaining the continuity and enhancing the security ex post facto of a CI has convinced the people of its capability and proven its reliability quite well (Hoffman and Shelby, 2017).

In the light of technical rationality, this would imply that even devastating terrorist attacks have been interpreted in the framework of the security of systems, and eventually, dissolved into black boxes’ increased ability to recover from any incidents and to take necessary lessons from such experiences. It is possible to explain the attacks as external acts based on the sudden use of violence which, despite their unpredictability, have succeeded in remaining within the limits of security estimates, but which can be circumscribed even better in the future by learning from them. The acts are interpreted as having hit an area that can be explained in terms of limited resources, meaning that the identified gap can be closed through additional investments without the need for fundamental change in the scheme or its underpinning logic.

The acts have failed to put under question the form of expertise that provides for security and certainty and evolves around the related issues. Instead, the acts are grasped as isolated cases that mainly indicate the intellectual relevance and insufficient resources of the systems, but not fundamental deficiencies in the general framework. Thus accounted, terrorism operates appropriately for the technical rationality: although the attacks constitute a real, unpredictable and serious security threat in the short term, the longer-term capacity and reliability of CIs are not questioned. A terrorist attack comes as a surprise, reveals vulnerability, indicates a weak link and reveals the limitations of knowledge, but it is eventually interpreted in a way that can be managed and effectively addressed by investing in stronger systems and broader up-to-date coverage.

Confidence in the logic of security creation is not undermined because the general framework appears fully capable in terms of making sense of attacks, providing for their prevention in the future, and thus not requiring deeper reflection or scrutiny. In other words, terrorist attacks fail to abuse the trust and confidence in the structures on which people rely (BaMaung et al., 2018). However, the fact that the black boxes’ internal logic has so far withstood them does not imply that it is free from vulnerabilities. To figure out the inherent vulnerability, it is necessary to delineate a trend in the development of terrorism that casts light on the need for alternative interpretation frameworks.

In view of the above, one may ask, what forms of terrorism would call into question the framework utilised in making sense of terrorist acts? To begin with, it can be said that creating and maintaining trust and certainty—even their ability to be taken for granted and blackboxed—are at the core of the security and credibility of CIs. Undermining trust and certainty requires systematic abuse of the systems, a deliberate effort to change the operational logic of the system qualitatively. This would call for sustained action to integrate the threat into the very methods and means upon which the maintenance of security of operations have been established. Terrorism would sneak in through the very operating methods that are perceived as being critical, continuously updated, effective, benevolent, field-tested and confirmed apparatus for identifying and solving problems. Terrorism could infiltrate a black box, settle in its inner world, and exploit it for its own purposes.

Such terrorism would cause systemic damage to society by affecting the various stages of designing, building, operating and managing protected and sheltered CI systems. The consequences would not be limited to isolated shocks or cascaded disturbances. Instead, they would reveal an innate vulnerability in how CIs are becoming increasingly complex, more critical and hence more and more capable in causing harm (Hellström, 2007). This would question the assumptions about the method applied in the accumulation of knowledge, understanding and expertise on which the security of CI relies. Such an act would be reflected in the mechanisms through which people and societal functions have become and continuously are dependent on CI systems. Well-intentioned investments in system reliability would be questioned in a way that undermines the framework considered legitimate. It would destroy social trust by creating anticipatory fear about terrorism: As Godefroidt and Langer (2018) showed, fearing terrorism destroys social trust, and this threat of terrorism does not even have to be real.

Such terrorism targeted at CIs would be less about a new tool in the terrorists’ toolbox, and more about a different logic of impact in which the vulnerability relates to intellectual foundations of certainty and security, not on the interruption or destruction of individual functions. When security and the ability to manage threats become thoroughly challenged, a shadow of doubt is also cast over systems operating with a similar logic. The essence and enormous size of black boxes would be revealed. It would be difficult for operators dependent on CIs to make informed decisions on the use of systems because the credibility of the information available would have been undermined. In this sense, the real impact of terrorism consists of the fact that the target group interprets the acts in ways that question the knowledge structure and the methods and means for strengthening it that have, in general, been sealed in a black box.