1 Introduction

Narrowly defined, the cyber sector of the economy includes internet publishing and broadcasting; data processing, hosting, and related services; and telecommunications. More broadly, it includes the equipment directly involved in cyber activity, such as computers, cell phones, and communication satellites, as well as support services. The cyber domain has seen a phenomenal rise in its role in advanced economies and, more recently, even developing ones. Most countries are increasingly dependent on cyber inputs for business, government, and private pursuits. Disruptions of the cyber system can have extensive consequences at all levels.

As with most disruptions in our lives, including major disasters, humans do not respond passively but have a number of existing and improvised coping measures. The term resilience embodies these reactions. Unfortunately, the concept of resilience is now over-used, which has contributed to great confusion about this worthy strategy. However, significant advances have been made to define and measure it. Briefly, by way of introduction, static economic resilience refers to utilizing remaining resources more efficiently in order to maintain function, while dynamic economic resilience refers to investing in repair and reconstruction to accelerate the pace of recovery (Rose 2004, 2017).

Economic resilience is thus a major way to reduce the economic consequences of disasters. One approach to analyzing and measuring its effectiveness is to incorporate resilience into economic consequence analysis (ECA) models. The state-of-the-art in this area includes sophisticated models of several types. In this paper, we focus on Computable General Equilibrium (CGE) models, which are widely used for ECA (e.g., Rose et al. 2007, 2009, 2017; Dixon et al. 2010; Sue Wing et al. 2016). These models have several attractive properties that make them especially valuable for ECA, including being based on behavioral responses of individual producers and consumers, having a role for prices and markets, having the ability to trace economic interdependence, and being based on a non-linear structure that can reflect flexibility of various components (Rose 2015), where flexibility is a key attribute of resilience (Zolli and Healy 2012).

Cyber resilience is a special case of economic resilience. Resilience related to cyber sectors pertains to: (1) their own (supply-side) reduction of product and service disruptions to their direct and indirect down-stream customers, which reduces disruptions to the cyber sectors’ own direct and indirect up-stream suppliers; and (2) reduction by their direct customers (demand-side) of their losses from cyber disruptions, which also reduces further upstream and downstream losses. Also, cyber capability itself can also be a source of resilience for other sectors, e.g., internet/telecommunication services facilitate messaging, teleworking, and the relocation of economic activity in the aftermath of a disaster. Cyber resilience is a prime example of interdependent infrastructure in terms of its close relationship with electricity services, though most of the technological considerations (e.g., substitute equipment) differ greatly between the two. Finally, cyber threats, unlike most natural disasters and technological accidents, can have truly national direct repercussions, such as bringing the commercial aviation and banking systems to a halt.

Several methodological advances have been made in explicitly incorporating resilience into CGE models over the past 15 years (see, e.g., Rose and Liao 2005; Rose et al. 2009, 2017; Sue Wing et al. 2016; Rose 2015). At the same time, several types of resilience are inherent, or already naturally included, in CGE models, in relation to their core focus (e.g., the allocative mechanism of price signals) and flexibility (substitution among inputs). In this paper, we will specify methods to incorporate a variety of cyber resilience tactics into CGE models.

To help guide the reader, we delineate the scope of the paper. First, our focus is on the disruption of production stemming from damage to the cyber system or curtailment of electricity supplies. This is in contrast to malware or spyware that often results in theft of data or short duration interruptions in economic activity with specialized fixes. Also, we focus on the cyber system itself in terms of direct impacts, and refer the reader to other work for resilience related to electricity networks (Rose and Lim 2002; Rose et al. 2007). Note that we define resilience in terms of actions taken after the disaster hits, as opposed to those prior to the event. The former is primarily intended to reduce business interruption, or loss of production, as opposed to the latter which comes under the heading of mitigation and is primarily intended to reduce property damage and involves a different range of actions. At the same time, we acknowledge that resilience is often a process, and resilience capacity can be built up in advance (e.g., back-up equipment or files, broadening the supply chain, emergency management drills), but not actually implemented until after the disaster strikes. Note, however, that the resilience metrics specified below can be translated to analogous mitigation metrics as well.

This paper is divided into six sections. In the following section, we summarize some theoretical foundations of resilience. In Sect. 5.3, we offer rigorous definitions of economic resilience and its many forms. In Sect. 5.4, we present a set of resilience tactics, especially for cyber disruptions, for ordinary businesses, and how they can be incorporated into a CGE model. In Sect. 5.5, we discuss resilience tactics at the meso and macro levels and how they can be incorporated as well. We conclude with a summary and discussion of some limitations of our methodology and how they can be overcome.

2 Theoretical Foundations

Economic production theory is a useful starting point for the incorporation of cyber services in economic decisions and operations, and subsequently for considering how these decisions and operations can be resilient to external shocks. In its simplest form, the production function characterizes how businesses convert a number of different inputs to generate various outputs. A number of “functional forms” have been developed to capture and analyze key relationships, such as input substitution, productivity improvements, and economies of scale (see, e.g., Silberberg and Suen 2000). Production functions have been refined over time to include behavioral considerations, which are especially important when considering resilience. These focus primarily on human factors such as perceptions and motivations, which apply both to normal economic activities and to resilience tactics to maintain them (Gigerenzer and Selten 2002).

Of all the economy-wide modeling approaches used to study economic consequences of disasters, CGE is the most powerful, in part because it is able to utilize some of the most sophisticated production functions, such as the constant elasticity of substitution (CES), translog, and generalized Leontief. It can also incorporate more rigid production functions for short-run analyses (say, less than 6 months). Dynamic CGE models can also address considerations relating to the capital stock of equipment in general and investment activities to replace it, key to examining long-term and far-ranging disruptions to economic activity and dynamic resilience to reduce business interruption.

Other microeconomic units of analysis have similar bodies of theory. The theory of consumer choice is the counterpart of production theory in a number of ways. It is typically based on utility functions with similar properties to production functions or various expenditure functions, including those that allow different expenditure elasticities across commodities. More recently, production theory has been extended to consumers with the advent of the household production function approach—households use a combination of inputs, including their own time, to produce household goods and services. For example, households combine raw food, water, energy, and time to produce meals. Application to disasters by Rose and Oladosu (2008) illustrates this in terms of a “boil water” decree, where households use contaminated water, energy, and time to produce potable water. This approach is especially useful in analyzing the value of some “non-market” inputs.

Government operations typically are modeled by two approaches. One is a simple model of providing goods and services—often just shifting their level or mix exogenously. At the other extreme are behavioral theories, which focus on non-economic (often cynical views of the bureaucracy) motivations, such as getting re-elected, rather than operating so as to maximize efficiency of resource utilization or service provision for their constituency. For the purpose at hand, we consider using a government production function analogous to the business production function. This is because cyber resilience is similar in government operations as in business operations. Moreover, it is not unreasonable to expect governments in many countries to be more attentive to their constituencies in a crisis and to be more inclined to optimize utilization of scarce resources, in part because such actions are highly visible and will help them get re-elected. This is also because government agencies are more typically users of cyber services than they are producers of them, i.e., cyber functioning as an input into the provision of government goods and services.

3 Defining Economic Resilience

The definitions below are repeated from the recent analysis and formulations in Rose (2009, 2017). Static Resilience in general in the literature refers to the ability of the system to maintain a high level of functioning when shocked (see, e.g., Holling 1973). Static Economic Resilience is the efficient use of remaining resources at a given point in time. It refers to the core economic concept of coping with resource scarcity, which is exacerbated under disaster conditions.

In general, Dynamic Resilience refers to the ability and speed of the system to recover (see, e.g., Pimm 1984). Dynamic Economic Resilience is the efficient use of resources over time for investment in repair and reconstruction. Investment is a time-related phenomena—the act of setting aside resources that could potentially be used for current consumption in order to re-establish productivity to be used in the future. Static Economic Resilience does not completely restore damaged capacity and is therefore not likely to lead to complete recovery by itself.

Note that the definitions are couched in terms of functionality, typically measured in economics as the flow of goods and services, such as Gross Domestic Product (GDP) or broader measures of human well-being, as opposed to property damage. It is not the property (capital stock) that directly contributes to economic welfare but rather the flows that emanate from these stocks either for businesses or households. Two things should be kept in mind. First, while property damage takes place at a point in time, the reduced flow, often referred to on the production side as business interruption (BI), just begins at the time of the disaster but continues until the system has recovered or has attained a “new normal.” Second, the recovery process, and hence the application of resilience, depends heavily on the behavior of economic decision-makers and on public policy. Of course, recovery is a multi-faceted activity. It is not as simple as, for example, just automatically rebuilding a school destroyed by an earthquake, hurricane, or armed attack.

For both static and dynamic resilience, ability implies a level of attainment will be achieved. Hence, the definitions of economic resilience are contextual—the level of function has to be compared to the level that would have existed had the ability been absent. This means a reference point must be established. In the case of static economic resilience, it refers to the case where resilience is entirely absent. In the case of dynamic resilience, the reference point refers to a recovery path where no special effort is made to accelerate the pace or shorten the duration of the disruption.

Another important distinction is between inherent and adaptive resilience. The former refers to aspects of resilience already built into the system, such as the availability of inventories, excess capacity, substitutability between inputs, and contingent contractual arrangements accessing suppliers of goods from outside the affected area (imports). Resilience capacity can also be built up through these means (“pre-positioning”), but either way is accessed after the disaster strikes.Footnote 1 Adaptive resilience arises out of improvisation under stress, such as Draconian conservation otherwise not thought possible (e.g., working many weeks without heat or air conditioning), changes in the way goods and services are produced, and new contracting arrangements that match customers who have lost their suppliers with suppliers who have lost their customers.

One can analyze resilience pertaining to the economy at three levels:

  • Microeconomic (individual business, household, or government)

  • Mesoeconomic (individual industry or market)

  • Macroeconomic (combination of all economic entities, including their interactions)

Underlying each of the levels of analysis, is an extensive body of economic principles, such as consumer and producer theory, the theory of markets, and macroeconomic theory. Over the years, these have been infused with the complexities of uncertainty, various perspectives on expectations of the future, and bounded rationality that make them even more applicable to resilience to disasters. CGE is an especially attractive modeling approach because it encompasses all three levels of analysis within either regional or national boundaries.

We proceed to discuss resilience at the three levels primarily in general terms and provide more examples relating to cyber in the following section. At the micro level, on the business supplier side, static economic resilience includes redundant systems, improved delivery logistics, and planning exercises. Even more options exist on the business customer side. Broadening the supply chain (see, e.g., Sheffi 2005) by expanding the range of suppliers in place or on a contingency basis is an increasingly popular option. Another is conservation of resources made all the more scarce by the disaster. Conservation is only minimally inherent because economists typically assume that most available efficiencies in resource use are currently being utilized; thus, most resilient conservation options pertain to adaptive applications. All inputs (capital, labor, infrastructure services, and materials) can be conserved, including using fewer cyber inputs per unit of output. The major obstacle is the necessity of the input in the production process, and cyber services are becoming increasingly critical and ubiquitous. Other resilience tactics include primarily input substitution, but also import substitution, back-up equipment, excess capacity, cross-training workers, relocation, and production recapture. Most of the resilience tactics associated with businesses are applicable to government and household operations as well.

At the mesoeconomic level, resilience can bolster an industry or market and include, for instance, industry pooling of resources and information and innovative pricing mechanisms. What is often less appreciated is the inherent resilience of market prices that act as the “invisible hand” to guide resources to their best allocation in the aftermath of a disaster (see, e.g., Horwich 1995). Some pricing mechanisms have been established expressly to deal with such a situation, as in the case of non-interruptible service premia that enable customers to estimate the value of a continuous supply of electricity and to pay in advance for receiving priority service during an outage, an option that is applicable to the cyber domain as well. The price mechanism is a relatively costless guide to redirecting goods and services. Price increases, to the extent that they do not reflect “gouging,” serve a useful purpose of reflecting highest value use, even in the broader social setting. Moreover, if the reallocation violates principles of equity (fairness), the outcomes can be adjusted by income or material transfers to the needy. Of course, markets are likely to be damaged by a major disaster in an analogous manner to buildings and humans.

At the macroeconomic level, resilience is very much influenced by interdependencies between sectors. Consequently, macroeconomic resilience is not only a function of resilience measures implemented by single businesses, but it is also determined by the actions taken by all individual companies and markets, including their interaction (see, e.g., Martin and Sunley 2014). Examples of resilience options at the macro level would be primarily inherent, e.g., economic diversity to buffer impacts on individual sectors or geographic proximity to economies not affected by disaster to facilitate access to goods or aid. One strategy would be to segment the cyber system so that it would be impossible to bring an entire national system down. Other tactics, primarily adaptive, include fiscal (e.g., infrastructure spending to boost the affected economy) and monetary policy (e.g., keeping interest rates low to stimulate private sector reinvestment). The macro level overlaps with the popular focus on “community resilience” and represents a more holistic picture (Norris et al. 2008). However, economists have long appreciated the importance of microeconomic foundations of macroeconomic analysis for several reasons. First, the macroeconomy is composed of individual building blocks of producer and consumer behavior as underpinnings for macroeconomic considerations stemming from group interactions. Second, behavioral considerations are best addressed first at the most elemental level because of the prominence of individual motivations for survival and coping mechanisms in anticipation of and in response to disasters.

The previous examples relate primarily to Static Economic Resilience. Dynamic Economic Resilience is applicable at all three levels, as well as in terms of expediting the recovery process and enhancing its outcome. At the micro level, this can be promoted through rapid processing of insurance claims and arranging financing so as to facilitate repair and reconstruction. At the meso and macro levels, it includes hastening and improving the economic effectiveness of the recovery process by optimizing logistics and coordinating recovery across sectors. Cross-cutting all three levels is adapting to changing conditions by promoting flexibility and translating short-run practices into sustainable ones through a continuous learning process (see, e.g., Chang and Rose 2012; Zolli and Healy 2012; Rose 2015).Footnote 2 We acknowledge, however, that the drive to recover more quickly is better evaluated in terms of the bigger picture, especially with regard to reducing vulnerability to future disasters in relation to both static (e.g., temporary relocation) and dynamic resilience (e.g., installing more reliable communications equipment and equipment that is easier to repair).

4 Resilience Tactics for Cyber Disruptions and Their Incorporation into CGE Models

In this paper, we focus more on the customer (demand) side—users of cyber equipment and services. It involves many more resilience tactics than the supplier side—producers of cyber equipment and services. Moreover, customer-side tactics are relatively less expensive.

4.1 Demand-Side Resilience

Ali and Santos (2012) found that the sectors most impacted by cyber outages were IT sectors themselves, computer and electronic products, administrative and support services, professional and scientific services, and financial sectors. Bisogni and Cavallini (2010) found the sectors most affected in the European community were computer and related activities, finance, real estate and related business activities, transportation, storage, and communications (see also the review of these studies and others by Wei 2015). Also, we note the complementary nature of cyber and electric power. Thus, any attempts to implement resilience in the cyber system would be undercut substantially if electric power is not available. Hence, we need to consider the major sources of resilience for this complementary electricity input, which would include batteries, distributed generation, and access to other power sources in general. Similar considerations pertain to water used for machine cooling at data centers.

Table 5.1 summarizes key features of the analysis of cyber resilience for businesses on the customer side. The table lists major categories of resilience and provides examples of specific tactics within each category applicable to the cyber domain.Footnote 3 The resilience categories apply to all production processes, but we have emphasized the cyber domain with our examples. Resilience tactics unique to cyber include special kinds of back-up systems such as clouds, wireless connectivity, use of batteries and other back-up power sources, and telecommuting. Each row of the table indicates a prior action that can enhance the corresponding resilience category and indicates the degree to which the resilience is inherent and adaptive. Also, the applicability of each resilience category to each factor of production is indicated by the following letter designations: capital (K), labor (L), cyber equipment (CE), cyber services (CS), electricity (E) and materials (M), as well as for the output (Q) that they produce. Upper-case letters representing the inputs or outputs reflect a strong resilience relationship, while lower-case letters represent a weak one. The same convention denotes the strength of inherent and adaptive resilience, but in this case is denoted by the letter X. For example, a firm can readily import all inputs except much of physical capital because of its immobility. That is, factories cannot readily be relocated but equipment can be; thus, this variable is relevant to relocation resilience, but is limited and hence connoted by lower-case letters.

Table 5.1 Microeconomic resilience options: business (customer-side)
Full size table

For example, in Table 5.1, a major category of resilience tactics is Input Substitution, which would include the use of back-up systems, wireless or satellite connections, paper records, and traditional couriers. A more subtle category is Conservation, for which examples include reducing non-essential uses and recycling cyber-related equipment. Conservation is only minimally inherent because economists typically assume that most inherent conservation options are currently being maximized. Thus, most conservation options pertain to adaptive applications. All inputs can be conserved. The major obstacle is necessity of the input into the production process. Similar notations are provided for other resilience options for the case of business customers. Note also that the various modifications apply not only to direct effects of cyber disruptions but also to indirect, in this case general equilibrium, effects, though the latter are less dependent on cyber inputs.

The last column of the table indicates how each category of resilience can be incorporated into a CGE model, including a reference to works that have done so. Most resilience tactics can be related to ordinary production function parameters or related to an expanded set of inputs. Some need be applied in an ad hoc manner, such as loosening input constraints or adjusting output. Typically, the inputs into economic activity serve as the independent variables for a formal production function in which the influence of several types of resilience can be linked directly to them or to the production function parameters.

The following is a summary of how various economic resilience tactics can be incorporated into a computable general equilibrium (CGE) model. At the outset, we again note the general effect of the distinction between inherent and adaptive versions of resilience. CGE models naturally embody several economic relationships that reflect inherent resilience. These emanate from the model being able to represent basic economic relationships in production here (and in consumption and single and multi-market interactions in general). Most adaptive resilience can be incorporated through parametric changes or ad hoc adjustments.

Conservation is a subtle form of resilience. Most economic models assume optimizing behavior, which implies that all inherent substitution possibilities have already been undertaken. Hence, in most applications, conservation would then have to represent the adaptive version. Rose and Liao (2005) have indicated how this form of resilience can be represented by changes in the productivity parameters of pertinent inputs in a CES production function, and have offered an algorithm for making this adjustment with use of empirical data. In standard production function analysis, one enters values of the variables into the production function, and then solves for outputs given these variable values and the production function parameters. To recalibrate a production function parameter in the aftermath of the disaster so as to reflect resilience, one can use the value of the inputs (including any fixed, or constant, levels) and a given level of output to solve for the parameters. In this case, they were able to solve for changes in the productivity term to reflect adaptive conservation by analytical methods. For this tactic and for the next one, the input and output values were obtained from a business interruption survey performed by Tierney (1997).Footnote 4

Most production function relationships in these models allow for input substitution, which reflects a base level of this resilience tactic. In the most common form of production function used in CGE modeling, the Constant Elasticity of Substitution (CES) function, the relationship is represented by the elasticity of substitution. Adaptive input substitution refers to enhanced substitution possibilities under stress. The Rose and Liao algorithm also applies to the determination of the increase in CES substitution elasticities to reflect this type of resilience.Footnote 5 However, given the complexity of the CES substitution elasticity, changes in this parameter required numerical methods.

Inherent import substitution is analogously automatically a part of a CGE model through the substitution between production within a geographic area and imports, as represented by Armington elasticities. Analogous to input substitution, adaptive import substitution would be reflected by increasing the elasticity parameter levels along similar lines of the Rose and Liao algorithm. Note that Armington elasticities apply both to interregional and international trade.

Relocation of economic activity can be modeled in a CGE context, though some important distinctions must be made between two possibilities (Giesecke et al. 2015). The first is for a geographic shift in plant and equipment to another location, followed by shifts in labor and materials for the supply of these inputs at the new location. The second is simply shifting production to a new location utilizing existing facilities (e.g., using excess capacity of branch plants), which then likely diminishes the necessity of geographic movements of labor and materials. If the geographic shift is within the region, this can be modeled by simply reducing the size of the initial shock. If the shift is to another region, then this can be modeled by ordinary interregional substitution of economic activity responding to a shock (constraint) on a productive capacity in the region directly affected by the disaster. The inherent version of relocation is thus reflected in the ordinary workings of the interregional CGE model. Adaptive relocation would be modeled by increasing the capital stock in the region to which the economic activity was shifted, or simply having the “increase” in the capital stock represented by an increase in the utilization of excess capacity.

Inventories are an inherent form of resilience because they refer to resilience capacity already in place. This tactic can be modeled by data on existing input inventory levels in each sector (U.S. Department of Commerce 2016). The percentage of an input held as inventory by each sector would then be used to adjust the percentage of initial disruption of that input in each sector downward (see, e.g., Rose and Wei 2013).

Excess capacity is another form of inherent resilience. Again, the percentage of excess capacity would be used to adjust the initial level of the shock, though, in this case, not with respect to material inputs but with respect to the capital stock of each producing sector. One can also apply the concept of excess capacity to labor by utilizing the unemployment rate in a similar manner to make adjustments, though taking precautions to account for labor skill differentials.

Input Isolation refers to a buffer against disasters when critical inputs are not needed in certain aspects of the production process. The most obvious case is the lack of the need for electricity in growing crops, or of water in many office buildings. For many years, this type of resilience has been referred to as “importance,” and adjustment factors have been developed for critical lifeline services such as electricity, natural gas, water, and communications (ATC 1991). We have renamed the concept to make its meaning more apparent.

Production Recapture refers to rescheduling production to a later date to compensate for reduced output during earlier periods of the recovery. This ability is dependent on two key factors. The first is the extent to which capital and other inputs are available (cf., cases where the disruption is simply caused by a power outage with no damage to the factory versus the case of an earthquake, for which both electricity is disrupted and the factory is damaged). Second is the length of the disruption. For short-term cases, customers have inventories and/or will not go to the trouble of lining up other suppliers, but long-term disruptions will likely cause the firm’s customers to abandon it. Production recapture is basically an adaptive form of resilience. It can be modeled by applying sectoral recapture factors (HAZUS 2013; Rose and Lim 2002) to gross output or GDP losses. These factors are nearly 100% for manufacturing sectors in the short-term but then are often assumed to decay to zero by year’s end for all sectors (Rose and Wei 2013).

Technological change is especially difficult to analyze and to measure in general. One approach that bears special note is that of Rose (1984), which refers to modeling technological change in an I-O context. It basically focuses on many rationales and methods for changing model parameters and is generally applicable to CGE modeling, since so many of such a model’s parameters (elasticities being the most notable exception) are based on an I-O table. However, all of the approaches refer to exogenous technological change, as opposed to change endogenously stimulated by explicit economic relationships, which are very difficult to model. The counterpart to exogenous technological change in the context of a disaster would be of the adaptive variety, while the inherent version of this tactic would already be ingrained in the economy. Endogenous technological change would thus not appear to be of much relevance in this context. Adaptive technological change is, of course, limited for short-term disaster recovery periods. Where it is applicable, it would be modeled primarily as fundamental changes in elasticities of substitution or productivity parameters, though likely in a more ad hoc manner than in the cases of input substitution and conservation discussed above. Additional parameters, such as those relating to the timing of the adjustment process of not just technological change, but to input and import substitution as well, would also be helpful.

Management effectiveness refers to organizational changes that can help maintain a firm’s functionality, or business continuity (Wein and Rose 2011). It can be modeled by an improvement in the labor input productivity factor (in a manner analogous to the method for incorporating adaptive conservation), or, in cases of more general effectiveness, in terms of a productivity parameter related to all inputs. The best way to approach this is to explicitly incorporate a managerial variable into the production function, so as to distinguish managerial and other (e.g., production line) labor, and to modify the former in terms of productivity enhancement.

Other forms of resilience are applicable in specific contexts. In the case of port disruptions, for example, which are highly vulnerable to cyber disruptions directly or to associated shipping or offshore oil drilling, one form of resilience is ship-rerouting, which can offset the disruption of economic activity in the directly impacted region or in the broader economy. For example, rerouting of oil tankers to a nearby port would still allow crude oil to be carried by pipeline back to refineries in the directly affected area, thereby muting the initial shock by the applicable percentage. Otherwise, the ship-rerouting simply results in a geographic shift in economic activity, though with a brief delay due to the extra distance traveled. The adjustment for this tactic would be analogous to that made for inventories or excess capacity. Of course, the adjustment would not be applicable if the ships were rerouted beyond the geographic scope of the model being used.

Export diversion refers to shifting goods intended for export to domestic uses. Care must be taken to account for the heterogeneity of goods in a given sector. Sectors comprised of relatively homogeneous goods (e.g., raw materials and primary manufacturing) are more likely to be helped by this form of resilience. The adjustment is just an ad hoc reduction in the sector’s initial supply disruption by the amount of the legitimate export diversion. This would be inherent resilience under ordinary circumstances, but adaptive resilience if previous unknown substitutions of differentiated products were made possible (see Rose et al. 2016; Wei et al. 2019).

One neglected aspect of the discussion above is the cost of resilience tactics. Ideally, these would be factored into CGE model simulations as well. However, this is less of a problem for several reasons. First, cost considerations are automatically taken into account for most forms of inherent resilience. Second, economic resilience on the customer side, which is the perspective of the discussion above, is relatively inexpensive, compared with economic resilience on the supplier side (e.g., redundant systems). For example, adaptive conservation more than pays for itself; important input substitution is just the cost differential associated with the supplied good (inherently accounted for in the model, and even for adaptive substitution). This is also the case for import substitution. The cost of inventories is just the carrying cost (already factored in). The cost of using excess capacity is close to nil. The cost of production recapture is just the payment for working overtime or extra shifts, where applicable. The cost relocation of activity to branch plants is relatively low, except perhaps for increases in transportation costs when the move is a long-distance, but this is automatically incorporated in CGE model. For physical shifts of plant equipment, there will, however, be moving costs not automatically included.

The discussion above has focused on resilience tactics that can be used to reduce the losses from disruption of cyber equipment and services. Another perspective is to view the use of these goods and services as sources of resilience for other inputs. The major example would be telework, most often characterized as telecommuting. This can greatly reduce the negative impacts of transportation system or fuel disruptions, as well as disruptions to family life that make it advantageous to stay at home (Cox et al. 2011). Another example would be the use of cyber-related automated systems to make up a loss of manpower. Still another would be the use of cell phones for broader communication purposes. The methodologies to incorporate these into CGE modeling would be similar to those noted in Table 5.1, such as loosening supply constraints on manpower as a result of telecommuting, and substituting cyber inputs for ordinary inputs.

The production theory framework just presented has limitations (e.g., assuming simple optimizing behavior and a select number of factors of production). It can be enhanced by incorporating features of non-optimizing behavior and other aspects of bounded rationality, more production factors, and additional managerial considerations (see, e.g., Gigerenzer and Selten 2002).

4.2 Supply-Side Resilience

On the supplier-side, the focus is on the manufacturer of cyber-related equipment and the provision of cyber services. The former relates to ordinary manufacturing, while the latter relates to business and professional services. What differentiates manufacturing of cyber-related equipment from most other manufacturing is the heavy reliance on one input: semi-conductors. And what makes society all the more vulnerable in this case is the fact that these inputs are produced in limited locations. Sheffi (2005) has documented the vulnerability of the cell phone industry, for example, to semi-conductor shortages following disasters affecting factories in Asia, and how Nokia survived by having a flexible supply-chain in contrast to the fate of Ericsson. Accordingly, the major sources of resilience for manufacturers would be inventories of critical inputs and lining up back-up suppliers, or initiating other flexibilities in the supply-chain, such as alternative transportation modes. Linkov et al. (2013) also stress the effects of managerial effectiveness in promoting resilience. The inclusion of these resilience tactics in a CGE model is very similar to the manner in which they are included with respect to the customer-side of the cyber industry.

Cyber service provision includes internet services, telecommunications services, software and tech support. The major distinction here is whether the product is primarily of a technical nature or otherwise. The first two are somewhat akin to electric service provision, and the above examples of supplier-side resilience are applicable here as well; however, one must add system redundancy as another resilience tactic, even though it is typically the most expensive of all possibilities. Completed software is less of a tangible commodity, and if it cannot be transmitted over the Internet, it can be transmitted by other means. Software development and progress can likely readily be shifted to other locations, unless it is so unique and sophisticated that its creators are impaired or immobile. Tech support is similar to software development, though its demand is much accelerated in time.

Table 5.2 presents resilience options on the supplier-side of the cyber domain. Most of the entries are analogous to those for Customer-Side Resilience, though there are several differences. For example, delivery logistics refers to how suppliers transport or transmit their products to their customers. Individual tactics include strengthening and/or shoring up wholesale and retail trade relationships and establishing contingency contracts with transportation companies. These actions can be strong for both inherent and adaptive resilience and are mainly applicable to the output variable. The major issue in implementing supplier-side resilience is the extent of network connectivity, which is typically damaged by disasters.

Table 5.2 Microeconomic resilience options: business (supplier-side)
Full size table

As noted before, supply-side resilience options are more limited than demand-side options and are also relatively more expensive, the primary example being redundancy. Note that these resilience options have not yet been simulated in CGE models to any significant extent, so no references to the literature are provided. However, the methodologies for their inclusion are similar to those in Table 5.1, though more of them apply to the output side, which has been further delineated according to general product output (Q), output of cyber equipment (QCE) and output of cyber services (QCS).

4.3 Government and Households

Both demand-side and supply-side resilience are applicable to the operation of government analogous to that business (Rose 2017). Additionally, government at various levels plays a broader role in economy-wide recovery. For example, increases in financial or in-kind disaster assistance, acceleration of their delivery, and improvements in the effectiveness of their distribution to the affected parties promote recovery. Most of these functions are a form of dynamic economic resilience (see, e.g., Xie et al. 2018). However, the provision of aid can have disincentive effects on resilience, just as it does for mitigation when those who suffer from a disaster because they have not undertaken mitigation believe they will always be “bailed out.” The government sector is also increasingly dependent on cyber systems. Emergency services and the military are high priority activities for which resilience is especially important. While the technological options presented in Table 5.1, as well as their costs, do not differ much between the application to businesses versus government and households, the benefits from these priority government areas of operation are sizable and extend beyond just the consideration of production activities to life safety and the preservation of the social and political system.

Household resilience on the “customer” side would be analogous to that presented for businesses (Rose 2017). For example, a household can readily import all inputs except infrastructure services and physical capital. Another example is that inherent conservation is primarily already accounted for by maximizing behavior, but we include it as at least weak, because not all households actually maximize their “production” relationships. Still, most conservation options pertain to adaptive applications. All inputs—capital, labor, infrastructure services, and materials—can be conserved, but the moderating factor is the necessity of the input into the household functioning, or, more formally, production process. In addition to customer-side resilience, households have supply-side resilience considerations with respect to providing their own services internally (e.g., using cyber services to prepare their income tax returns) or externally to the economy (e.g., providing labor or capital). The former can be modeled in the context of a household production function (see, e.g., Rose and Oladosu 2008), while the latter is part of the normal factor market workings of the CGE model. The resilience tactics exemplified in Table 5.1 apply to households but to a much more limited extent than to businesses in terms of breadth and scale. Although most household activities are not part of the National Income and Product Accounts, and thus do not typically show up in standard economic indicators such the ones referred to in this paper, they can be measured, as can resilience to maintain these activities, with some non-market valuation techniques.

5 Formally Incorporating Resilience at the Meso and Macro Levels

At the meso level, the predominant source of resilience is the role of prices and markets in allocating resources. This is probably the greatest advantage of CGE modeling over all other alternatives, such as I-O and macroeconometric modeling. This is an inherent source of resilience and is embodied in the formulation of CGE models through their supply and demand functions for factors of production, intermediate outputs, and final goods and services. One can measure the source of resilience by simulating the post-disaster situation at pre-disaster prices and comparing the outcome with a flexible-price post-disaster outcome, including changes in variables and parameters. One caveat, however, needs to be issued in the case of extreme disasters. Here, markets may be in disarray, and various imperfections are likely to result in a situation where prices no longer reflect the true value of resources. Several adjustments need to be made for this contingency. Here, CGE does serve a useful purpose of identifying the ideal workings of market, so that policymakers can gauge the extent to which the post-disaster situation deviates from this and then take steps to strengthen markets or administer prices to move toward this ideal outcome.

Resilience at the meso level is also related to supply chains, which have been discussed above. The spatial counterpart to this, and also very relevant to cyber or networks in general, relates to connectivity. One way to model this, albeit a most difficult one, is to overlay the spatial network onto the spatial model of the economy. A prime example is the work of Rose et al. (2011), in which the Los Angeles City economy was divided according to water service areas and how the water system network is overlaid, so that the economic consequences of spatially differentiated loss of water service could be accurately estimated. This provided a stronger basis for the evaluation of static resilience at the micro, meso, and macro levels. An analysis of this type also provides a stronger basis for evaluating dynamic economic resilience that can be used to prioritize repair and reconstruction of pipeline capacity so as to both increase function at any given point in time and to recover more quickly (see also Cagnan et al. 2006). A similar approach is applicable to cyber networks, though with some modification. For example, wireless networks have much different connectivity issues than do “solid” networks. In addition, cyber networks can have much broader coverage, including to the full national level.

The macro level can be thought of in two ways. First, it is the aggregation of individual actions, and the way to model the resilience as discussed above. The second is to note that the macro level is not just the sum of its parts, but involves various synergies or aspects of aggregate behavior or policy. This is much more difficult to model. One major aspect of the macro economy can be readily modeled in a CGE context, that being accessing imports when there are shortages of inputs previously produced domestically, or where export markets provide an alternative to the slump in domestic demand. Here is another CGE strength, where imports and exports are readily modeled through choice functions and so is the inherent resilience associated with them. To adjust for adaptive resilience, one needs to modify import substitution elasticities (and the counterpart transformation elasticities on the export side), but this can be done in an analogous manner to that developed by Rose and Liao (2005) for domestically produced inputs. Some government policy at the macro level can also be modeled. Fiscal policy, as through a stimulus from government spending or tax relief, is a standard application of CGE, without much need for modification. On the other hand, CGE models have typically lacked sophisticated monetary and financial sectors, and hence several aspects of this type of policy (e.g., open market operations) cannot readily be modeled, though important advances are in the works (Nassios and Giesecke 2018). However, adjustments in the interest rate can be modeled in various ways. One is simply ad hoc adjustments, while the superior approach would be to use a dynamic CGE model, where the interest rate represents an intertemporal opportunity cost. Again, the cyber domain differs from most other infrastructure types in being vulnerable to national level disruptions. Moreover, such a broad catastrophe can transmit shock waves throughout the entire globe in financial markets and goods markets. Supply-chain resilience would be epically important in this context.

6 Conclusion

Economic vitality and security are becoming increasingly reliant on cyber systems. In fact, of all of the types of disasters we face, cyber threat is one of the few that can have truly national, if not global, implications. Research on the prospects for pre-disaster mitigation of this threat and post-disaster resilience to its disruptions are of paramount importance.

This paper has presented various methods to incorporate resilience into a state-of-the-art approach to economic consequence analysis of disasters—computable general equilibrium analysis. The methods stem from a variety of sources, but are based for the most part on the author’s own research on CGE and related I-O modeling. While they have been given explicit attention in relation to the cyber threat, nearly all of them are applicable in a similar manner to analyzing resilience in the face of the wide variety of threats facing most countries and regions today and in the foreseeable future.

We make no pretense that the methods presented are the final word on this topic. More research is needed on the conceptual side and operational side, especially with regard to improving on some ad hoc adjustments. The greatest challenge, as is typical, lies in collecting and refining data that can lead to the empirical implementation of the methodologies.