4 Risk and the Information Society From its very origins as ‘Arpanet’ in the United States in the 1960s, the internet was designed to be an open system that allowed any one point on a network to receive messages from any other point, and to allow information find multiple routes from one point to the other. Despite the fact that there are now billions of connected devices connected to a network that spans the globe, that fundamental principal persists, and in fact has been central to the rapid growth of the internet and its utility to humanity. However this openness and ease of connection also facilitates the use of the network for malicious activities. Over time, and as the internet has grown in importance, the potential range and impact of such actions have grown, bringing with them a wide range of new risks to critical social and economic functions. This Section outlines those key risks for Ireland. 4.1 Strategic Risks At a very high level, developments in cyber security pose two fundamental challenges for Ireland. Firstly, the a-spatial nature of the internet exposes the State to new and rapidly developing global threats, including those developed and deployed by threat actors with very significant resources and expertise. These threats manifest at a national level in a variety of ways that make detecting and mitigating the associated risks difficult. The fact that the global security environment is in a particularly dynamic phase is also pertinent; the apparent return of ‘great power’ politics in international relations, accompanied by tensions over trade and technology vendors, pose particular challenges for small, open economies like Ireland. Secondly, the technological base of the Irish economy has developed significantly in recent years; the State is now home to a large proportion of Europe’s data (upwards of 30% according to some industry assessments) and the European headquarters of a number of the world’s largest technology firms. Critically also, the conceptual evolution of cloud computing has had profound implications for Ireland. In many cases, rather than being passive repositories of data, these centres are now home to live operational software environments; an outage or incident affecting one of those facilities could therefore have immediate disruptive effects on infrastructure or business across the EU or globally. In turn, this means that the infrastructure supporting these centres, public and private, now has an elevated security and economic risk associated with it. Recent years have seen the development and regular use of very advanced tools for cyber enabled attacks and espionage, and, likely for the first time, the physical destruction of Critical National Infrastructure by cyber enabled means. As such, the field of cyber security 13