It’s a gray late-September Sunday in San Francisco, a few weeks after the carnage at the World Trade Center, and my dog and I are walking along the beach near the Golden Gate Bridge. The huge structure seems graceful, spare and absolutely immovable. Yet with a brain steeped in movie special effects and, now, the all-too-real TV images of September 11, I can’t help imagining the scene if a 767 were to rocket down out of the clouds, decapitating one of the bridge’s towers or snapping the main suspension cables. I can see wires recoiling in slow motion, the main span sagging and shearing apart, cars and trucks and pedestrians plunging into the bay 67 meters below.

How many people are imagining similar horrors in their own cities, where the skylines remain unscathed? Ever since the seemingly invincible Twin Towers disappeared in a cloud of dust, Americans have been spooked about the danger to the national infrastructure. Naturally, we’re wondering if anything can be done to harden skyscrapers against suicide attacks. But we’re also reexamining our entire technological fabric-buildings and bridges and tunnels, stadiums and train stations and shopping malls, water supplies and the electrical grid, computer and telephone networks, roads and railways-and asking how it can be made more resistant to the predations of terrorists. “We have to start envisioning, and preparing for, worst-case scenarios,” says Nancy Greene, president of the American Civil Defense Association, a Starke, FL-based nonprofit organization dedicated to preparing the population for natural and unnatural disasters. “People are finally starting to wake up, but unfortunately it takes this sort of action to make it happen.”

The good news, say Greene and other experts paid to think about such things, is that there is little call for catastrophism. The country’s sheer size and the distributed nature of many aspects of the infrastructure-from roads to centers of commerce to communications-limit the amount of disruption any single terrorist group could cause. But that kind of resilience is weak in other interconnected systems such as the power grid and our water system and even missing entirely from the structural framework of buildings and cities. If engineers could beef up those interconnections already in existence and introduce them where they’re nonexistent, we could limit the damage from an attack even further.

The key lies in developing and deploying technologies that will tie infrastructure components together into a system that’s far smarter and more self-aware than anything we have today. Engineers, security consultants and authorities on counterterrorism are working hard to weave together the threads of this technological fabric, which will be pervaded by instruments that can sense harmful chemicals in a reservoir, relay critical data about a damaged building’s structural integrity to rescue workers, help map escape routes or streamline the flow of electricity in a crisis. These high-tech networks-joined with simulation tools, enhanced communications channels and safer building designs-could go a long way toward creating an “intelligent city,” where danger can be pinpointed and emergency response directed with precision.

The Power of Diversity

The template for this new, more secure infrastructure-already replete with interconnected redundancy and a kind of intelligence-is the Internet. Its underlying packet-switching protocol allows data blocks such as e-mail messages to be chopped up, scattered through the network via whatever pathways are open, and reassembled by the addressee. The destruction of one or even several routes may slow down data but doesn’t prevent it from reaching its final destination. “The Internet was designed to survive nuclear war, so it will automatically route around disruptions. That’s a good model for thinking about some of the other things like electricity and the 911 system,” says James Andrew Lewis, a senior fellow and director of technology policy at the Center for Strategic and International Studies in Washington, DC.

The nation’s water supplies already share some of the Internet’s hardiness. Rare is the city that depends on a single source for its water. New York City, for instance, draws water from 19 reservoirs and three lakes in upstate New York via an interconnected network of tunnels and aqueducts. If terrorists were to blow up one aqueduct, the others would still flow. If they were to dump biological agents such as botulinum toxin into one reservoir, it could theoretically be cut off from the system until purified.

But much more could be done to keep drinking water safe. For example, “We could instrument our reservoirs [to detect contaminants] very cost effectively and very quickly,” suggests Roger McCarthy, chairman of Menlo Park, CA-based Exponent Failure Analysis Associates, which consults with industry and government on disaster response and readiness. In fact, the U.S. Environmental Protection Agency was granted $2.5 million in federal funding this year for research on bioterrorism, including the development of new technology for detecting biological agents in water (see “Detecting Bioterrorism,”). And researchers at Sandia National Laboratories in Albuquerque, NM, are already field-testing tiny electronic sensors that can be lowered into reservoirs or underground wells to sniff for toxic chemicals. The sensors contain “chemiresistor” chips that measure changes in electrical resistance caused by volatile organic compounds; this data flows to collection stations where scientists can analyze the electrical signatures produced by the different compounds, identifying contaminants without having to transport actual water samples to the lab. The data can also be transmitted wirelessly to Web servers that would help spread the information to water safety officials around the country.

Ensuring that such information would get to the people who can use it is a key part of efforts to shore up the infrastructure. And as one of eight areas singled out by the federal government’s Critical Infrastructure Protection program-launched by President Bill Clinton in 1998 amid growing concerns about chemical, biological and computer-based attacks-the nation’s public water supplies will soon be linked to an Internet-accessible information-sharing and analysis center. Water utilities will pay a fee to join the exchange and use it to access and distribute data about contaminants found in the water supply as well as obtain intelligence reports from agencies monitoring terrorist threats.

The Washington, DC-based Association of Metropolitan Water Agencies, in charge of implementing the system, is patterning it after similar centers already operating in banking and finance and information technology. Other information-sharing systems are planned for transportation, telecommunications, emergency services, electric power and oil and gas distribution-all with the goal of giving government and private industry timely information about events disruptive to operations. “We’ve got to figure out how to get effective cooperation between local, state, federal and private organizations,” says Randy Larsen, director of the ANSER Institute for Homeland Security, a nonprofit research organization in Arlington, VA, that consults with the government on national security issues. The centers, he says, mark a good start in that direction.

Cooperation and information sharing aren’t all that’s needed, however. Major parts of the infrastructure must be modernized so they can absorb and respond to disruptions more quickly and flexibly, observers say. The electrical grid, for example, needs new computerized controls to ensure that stresses on the system-whether in the form of a deliberate attack or simply a high-demand summer day-don’t lead to widespread outages.

The problem isn’t a lack of interconnections. While some power industry critics are calling for the construction of new transmission lines to add redundancy to the network, most regions of the nation already have several alternative paths for getting power from point A to point B. The real difficulty lies in controlling the flow of electricity. Today’s power systems can’t smoothly siphon electricity from overloaded lines to those with unused capacity, nor do they have any way of damping sudden disturbances such as voltage surges or selecting the best transmission path around a local outage. In short, as Lewis explains, the grid lacks the Internet’s inherent resilience: “If part of the grid goes down, the rest of the system doesn’t figure out how to route around it.” And in an emergency, that means engineers must scramble to reroute power manually, either from a control center or by making manual adjustments to transformers in the field. “It’s a dumb, antiquated system with no real architecture, so of course it’s vulnerable to local attack,” says McCarthy.

But here, too, help is on the way. Companies such as Siemens, ABB and Mitsubishi Electric are already testing new “power electronics” devices that can help automate the flow of electricity and smooth out unwanted fluctuations. One sophisticated switch, known as a gate turn-off thyristor, can detect lightning-speed spikes in power voltage and turn itself on and off fast enough to tame them and let controllers redirect excess power. Using these new power processors, which are being tested on key transmission lines that send power from upstate New York to Manhattan, engineers will be able to shunt power from one line to another at the touch of a button (see “A Smarter Power Grid,” TR July/August 2001). In emergency situations, the new devices should help grid managers switch seamlessly between primary and backup generating stations and transmission lines, minimizing the effects of attacks on individual facilities.

Building the I-City

Beefing up the interconnections of a city’s utilities will go a long way toward making urban areas more resilient in the face of disaster. But what about strengthening the interconnections of the city itself? The same kind of redundancy and diversity found in the Internet, the water system and the power grid could be incorporated into city buildings and structures. Connecting those components electronically and then monitoring them could provide emergency-response crews with critical and timely information about any damage.

The system begins on the structural level with the buildings themselves. Additional support elements and secondary evacuation routes could help ensure that an event that compromises part of a structure doesn’t lead to a catastrophic loss of life. Oral Buyukozturk, a professor in the MIT Department of Civil and Environmental Engineering, calls this principle “the technology of redundancy.” Backup systems “should be incorporated into structures such that failure cannot be reached in one step,” he explains. “Rather, it should take several steps.”

While additional technologies such as stronger fireproofing might have delayed the accordion-like collapse of the World Trade Center towers, no one is suggesting that they could have prevented it. But the fact that few people escaped from offices above the stricken floors suggests that the airplane impacts did cut off most of the emergency stairwells in one step. And that, say Buyukozturk and others, brings the adequacy of tall-building evacuation systems into question. “We need better fire prevention methods and materials and better evacuation plans for tall buildings,” Buyukozturk says. “The stairway should only be the first level of evacuation. The second level should perhaps be a special vertical tunnel or elevator, maybe installed in a tube made of a material such as reinforced concrete that is less affected by heat.” Buyukozturk points to the pressurized service tunnel between the two railway tunnels under the English Channel as a working example. Thanks to the escape route the service tunnel provided, a November 1996 train-car fire that raged for nearly nine hours in one of the railway tunnels-causing considerable structural damage-killed no one.

When it comes to saving lives and stemming chaos in an emergency, it’s also crucial that infrastructure managers are able to act intelligently. To do that, they need information. A growing number of engineers and city planners say the kind of intelligence exemplified by power electronics and the information-sharing and analysis centers should be woven through a structure’s framework.

Researchers at Xerox’s Palo Alto Research Center, for example, are proposing that legions of tiny, wirelessly interconnected sensors literally be mixed into building materials to provide a continuous report on a structure’s physical state. “If you have sensors that are dirt-cheap and untethered-meaning they operate either on batteries or on passive energy that can be beamed to them-they could be blended into building materials such as concrete or brick,” explains Feng Zhao, principal scientist of Xerox’s Collaborative Sensemaking Project. “If each smart brick’ has embedded sensors wirelessly communicating with other bricks, then during an emergency they can detect the extent of the damage.”

Suppose a terrorist bomb blows a hole in a wall made from smart bricks or other networked materials. Some sensors would be knocked out of commission. But data collected from those that remained could allow structural engineers to quickly determine how big the hole is and how much stress has been placed on the remaining structure, explains Zhao. Even the demise of sensors could provide valuable information. “If these sensors are self-locating and part of the structure collapses, then as these bricks fall they are going to record and transmit their displacement,” Zhao adds. “Maybe you can reconstruct their trajectories to see exactly how the building collapsed and where people might be trapped, and you can actually send rescue workers to the right place. That could be really useful.”

Under more typical conditions, such sensor networks could be used to monitor the vibrations of passing vehicles or even footsteps, giving them obvious applications in the worlds of surveillance and military intelligence, which explains why Zhao’s group is partly funded by the U.S. Defense Advanced Research Projects Agency. But Xerox’s current prototype sensors range from a little larger than a quarter to the size of a shoebox, not quite small enough to incorporate into building materials. Zhao predicts it will take five to 10 years to make the hardware tiny enough and cheap enough-and suitably beef up the needed communications and data analysis software-to realize his vision. Nevertheless, he says his telephone has been “ringing off the hook” since September 11. “A lot of people think our sensor technology is right at the middle of making sure our cities are safer.”

Indeed, such technologies could readily be adapted to monitor entire cities and coordinate disaster response, says Franz-Josef Ulm, a colleague of Buyukozturk in MIT’s civil and environmental engineering department. “For about two years we’ve been discussing the concept of the I-City,’ where basically you use monitoring and simulation of the physical state of the infrastructure-tunnels, bridges, buildings and so forth-to solve questions of the operations of the city,” says Ulm.

One small test of the I-City idea is occurring on the MIT campus, where Ulm’s students are wiring a flagpole with sensors that will monitor its temperature and movements caused by wind. The data will be sent to a server computer that displays the stats in real time on the Web. Meanwhile, simulation software will use the data to predict how much time remains until the flagpole fails from structural fatigue.

If these same kinds of sensors were sprinkled throughout a building’s architecture, they could transmit the information upward from individual structures to the city monitoring station to a national antiterrorism or disaster center. They could even be used to coordinate law enforcement and military responses. “How will we even know we are under attack in the 21st century?” asks the ANSER Institute’s Larsen. “If you have an airplane crash in Chicago and the 911 system goes out in Sarasota and you have a big petroleum fire in Houston, are these just random acts? One of the things we need is a national command center, so we know an attack is going on, and that sort of real-time information is going to be very important.”

A Measured Response

Because it’s so difficult to know where terrorists will strike next, there is a natural impulse to retrofit as many components of the infrastructure as quickly as possible. But the resulting expense could be both crushing and ultimately futile, since terrorists might simply select targets that haven’t yet been hardened. Most experts are therefore recommending a measured, planned approach to infrastructure protection, starting with a realistic look at threats and vulnerabilities. “We can’t guard against every contingency, and there’s no point in trying to do so,” says policy analyst Peter Chalk, a specialist in national security and international terrorism issues at the Rand Corporation in Arlington, VA.

One prediction security experts can make is that the next attack probably won’t resemble the last one. Thanks to heightened airport security and passenger awareness, for example, it’s hard to imagine another attack using hijacked planes succeeding. “The plane as a delivery vehicle [for destructive energy] has been substantially abrogated just because of recent history,” opines Exponent’s McCarthy. But that doesn’t mean landmarks like the Golden Gate Bridge are out of peril; indeed, notes McCarthy, there’s a real threat to bridges and other structures in coastal cities from ships laden with explosive materials such as petrochemicals.

Foreseeing true threats and responding appropriately will require a new kind of thinking and a sustained sense of urgency, McCarthy and other experts say. As the immediate trauma of September 11 fades, there’s a strong and understandable temptation to return to business as usual. But those who design, build and maintain the infrastructure are realizing that they must now make planning for the worst a part of their everyday work.