Imagine a hacker, armed with nothing more than a laptop, taking down the power grid, leaving millions without running water, refrigeration, lighting, access to money, technical devices, and eventually food and medicine―for weeks, or longer. This scenario is far closer to plausible for all manner of critical infrastructure because the long-predicted convergence of Information Technology (IT) and Operational Technology (OT) is now reaching critical mass.

The interlock of these two traditionally distinct technology domains is both logical and inevitable in today's increasingly digital world. IT is enhancing the feature sets, efficiency and operations of the OT infrastructure that runs both enterprises and nation states. While this convergence of technologies brings significant benefits, it also creates function as a ripe and readily available attack surface, introducing exponentially greater risks than the already onerous cyber impacts of data compromise or network failures.

Pragmatically, IT/OT convergence forces the legal profession to think in a new way about guiding clients, litigating liability and legislating to address an unprecedented dimension of threat.

New Attack Surface, New Crimes and Liabilities?

OT professionals must focus on functional operation uptime for the infrastructure that drives our industrial economy. OT itself often leverages supervisory control and data acquisition (SCADA) systems. These SCADA systems allow industrial organizations to control a complex variety of industrial processes locally or remotely. IT enhances the OT capacity to monitor, gather and process real-time data regarding those industrial processes taking place, for example, on oil rigs, in turbines, water management systems, energy plants or manufacturing lines. This convergence allows data to be useful to its full potential; however, it must be put into a context that supports effective business and operational decision-making.