Keywords

1 Introduction

The urbanization phenomenon is encountered in every corner of the earth and directly affects almost 50% of its population, with the forecasts of experts showing even higher percentages in the years to come (Shen et al., 2016). The population concentration and growth in urban areas lead to the need for continuous improvement in the management of resources, goods, services and infrastructure. In order to meet these needs of the growing urban life and achieve better decision-making, it is necessary for cities to transform into smart cities. This transformation will positively impact the quality of life of their citizens, support economic development and promote environmental sustainability (Silva et al., 2018). This transition has already been attempted by a number of cities, and experience has shown that it directly or indirectly affects all urban activities while engaging all stakeholders, city members and institutions (state, companies, universities and citizens) (Shamsuzzoha et al., 2021).

For the long-term sustainability of these multidimensional cities, special attention to risks is required by those responsible for the development and operation of smart cities. Particular attention has already been devoted both in research and in the implementation of new technologies, in order to address relevant risks. Typical examples are the models that have been developed for assessing the personal information risks managed within a smart city (Yan et al., 2020), or cyber-security risks related to digital assets (Sheehan et al., 2021). Still though, we are far from saying that risks have been addressed entirely. Risk management aims to prepare those responsible for possible incidents in order to avoid improvising responses when they occur (Pym, 1987). Identified risks and their potential treatment strategies are key elements in the design and management of smart cities. Nevertheless, a detailed risk taxonomy for the risks of smart cities is still missing from the literature (Ullah et al., 2021). The aim of this chapter is to alert smart cities’ designers and other stakeholders on the potential risks that can occur, as well as present some high-level strategies to overcome such risks.

2 The Smart System as a Multisystem Construct

In order to achieve the transformation of a city into a smart city, the integration of new technologies is required, so that the digital and the physical world can merge. Therefore, sophisticated technologies compose the basis on which the philosophy of a smart city is built. Fundamental technologies that build a smart city are Information and Communications Technologies, with their main applications being:

  • Internet of Things (IoT): a network which includes a plethora of technologies (e.g. sensor nodes, software solutions, information technologies), aiming at the generation, transfer and exploitation of data (Nižetić et al., 2020).

  • Big data: massive volumes of data produced from multiple sensors (Rathore et al., 2015).

  • Cloud computing: The National Institute of Standards and Technology’s defines cloud computing as “a model for enabling ubiquitous, convenient, on-demand network access to a shared pool of configurable computing resources (e.g., networks, servers, storage, applications, and services) that can be rapidly provisioned and released with minimal management effort or service provider interaction” (Mell & Grance, 2011).

All the above-mentioned technologies resonate in every urban activity. The main identified dimensions in the literature are smart economy, smart mobility, smart environment, smart people, smart living and smart governance (Giffinger et al., 2007). The “smartness” of these categories is more than just a fancy term. It describes the tendency to improve the economic, social and environmental conditions within cities in a people-oriented way (Silva et al., 2018).

As these urban activities overlap, so do the actuated technologies. A typical example is big data generated in the context of the smart city. More specifically, the debate in the scientific community raises the question whether it is more efficient to collect and manage data under a single roof (centralization of data) (Economic and Social Council of United Nations, 2016) or whether separating data by city dimension is an effective solution to avoid failures and vulnerabilities (decentralization) (Tariq et al., 2020). Another example are the sensors within smart cities, which are the core of smart cities and produce a large amount of data (Ahad et al., 2020). The data from the same sensor can be useful to stakeholders from different fields of activity and can contribute significantly to their decision-making. Finally, the overlapping functional areas are favoured by the existence of the Internet of Things, which not only allows the extraction of data from existing infrastructure but also supports their fully autonomous operation through the use of artificial intelligence (Mainzer, 2020).

These interrelations and overlaps of activities and technologies have an impact on the smart city’s stakeholders. The main stakeholders are the government and local authorities, industries, universities and citizens (Fernandez-Anez, 2016). Each one has their own role, their own contribution and their own requirements in relation to the smart city. Therefore, it is almost impossible to carry out changes and developments in the city’s sectors, either in terms of structure or technologies, without affecting their sustainability, since the interests of the stakeholders are also often conflicting (Shamsuzzoha et al., 2021). However, the need to synthesize and manage these technologies in smart cities with a citizen-centred approach cannot be overlooked (Anthopoulos et al., 2007).

Τhe multilayered application, integration and interconnection of new and complex technologies in an intertemporal establishment like a city comes along with risks, both threats and opportunities, while their management is more complicated than the elements that they compose it (Ullah et al., 2021).

Risk management is a systematic process and consists of the following subprocesses: identification, analysis, evaluation, treatment and monitoring and review of risks (International Organization for Standardization, 2018a). Identifying those risks has a complexity proportional to that of the technological systems being installed as well as the number of interconnections, but it is the first step towards their management.

3 Methodology

3.1 Systematic Literature Review

In order to identify the risks of smart cities and their possible mitigation strategies, a systematic literature review (SLR) was undertaken. SLR contributes to the research by setting objective criteria for the selection of the literature to be included, in order to minimize as much as possible the bias and subjective judgement of the researchers (Nightingale, 2009). The literature review process that was followed is summarized in Fig. 1.

Fig. 1
figure 1

Steps for SLR (Xiao & Watson, 2019)

Full size image

The Preferred Reporting Items for Systematic Reviews and Meta-Analyses (PRISMA) guideline is used to present the results of the literature review. This guideline is a statistical approach to the results to promote transparency and full inclusion of the results of the literature review (Page et al., 2021).

3.2 Selecting Articles

For the search of the journals, the Scopus electronic database was used. Scopus database has a plethora of publishers, whose number exceeds 5000, while the number of peer-reviewed journals amounts to 34,500 (Gupta et al., 2019). Moreover, Scopus covers a wide range of scientific fields, for example, Computer Sciences, Social Sciences and Information Science (Mat Ludin et al., 2017).

In order to select the articles for analysis, certain selection criteria were applied, as presented in Table 1. Following the search method of article “title/abstract/keywords” (Derakhshanfar et al., 2019), 2378 results were identified. Next, only journals were selected (excluding conference proceedings, book series, books and other types of literature), to ensure the quality of the included publications, which is guaranteed through the peer review that journals go through (Prater et al., 2017). To include the most up-to-date literature, the search was limited to the last decade. Afterwards, only relevant subject areas were kept, excluding Mathematics, Environmental Science, Physics and Astronomy, Materials Science, Earth and Planetary Sciences, Chemistry, Medicine, Biochemistry, Genetics and Molecular Biology, Chemical Engineering, Agricultural and Biological Sciences, Pharmacology, Toxicology and Pharmaceutics, Neuroscience, Nursing and Immunology and Microbiology. The limitation of the subject areas resulted in 263 journal papers, followed by the restriction of the language to English, coming to 251. The document type was limited to articles, excluding conference papers, reviews, editorials, notes and undefined types, concluding to 231 papers. Finally, based on the research goals, 43 papers were finally selected, reviewing their titles, abstracts and then their content.

Table 1 Stages of setting criteria for the SLR
Full size table

3.3 Risk Clustering

To ensure homogeneity of language and lack of repetition and to avoid misinterpretation within the presentation of identified risks, intervention on the description of certain risks is necessary (Le et al., 2019). For this cause, the description of many risks was fine-tuned, while risks with slightly different names but with the same meaning were unified. More specifically, in many cases risks did not follow the typical risk metalanguage, and there was a mix up of causes, risks and impacts. For example, “overestimating the positive impacts of technology” (Ambrosino et al., 2015) was described in one study as a cause for other risks, while “delay in actual deployment of new technologies” (Lee et al., 2013) was described as a cause from strategic and legal risks. Also, as shown in Table 2, the same risk could be described by different authors in different terms.

Table 2 Examples of different terminology used for the same risk
Full size table

4 Existing and Emerging Risks in the Development and Operation of Smart Cities

Risk as defined in ISO 31000:2018 is the “effect of uncertainty on objectives” (International Organization for Standardization, 2018b), while emerging risks are “either new risks or familiar risks that become apparent in new or unfamiliar conditions” (International Risk Governance Council, 2015). In the case of smart cities, this uncertainty is compounded by the city’s exposure to new technologies on which cities are founded. This exposure to new technologies is the factor that increases the uncertainty within a smart city compared to a “non-smart city”. More specific, these risks have their source in precisely this interwovenness and interconnection of the technologies used, their breakthrough nature and rapid pace of development. In addition, the smart systems that consist of these technologies are creating greater risks than the risk of each separate component (Axelrod, 2013).

All of the above leads us to the conclusion that, the importance of risk identification is particularly high, as the failure to identify certain risks implies failure to analyse them and subsequent exposure to that risk in the development and operation phases. The number of risks identified from literature review after properly naming and grouping them is 65, and they are presented in Table 3, in a Risk Breakdown Structure (RBS) , accompanied by the percentage of the number of appearances of the risks in relation to the total number of risks. The RBS is used to present the identified risks. The risks in the RBS are categorized in groups with a hierarchical structure, allowing the reader to concentrate on the subjects that concern him.

Table 3 The RBS of smart cities
Full size table

5 Risk Management Skills and Mitigation Strategies for Safe Smart Cities

5.1 Risk Management Skills

To ensure the sustainability of smart cities, it is essential for both developers and managers of the cities to be equipped with risk management skills and knowledge to identify, analyse and treat risks. Only in that way they will be able to enhance opportunities and mitigate threats. Achieving effective risk management requires the risk manager to be equipped with certain competencies and skills. Risk management in smart cities is a complex and multidimensional process, and this requires at least the following:

  • Technical skills: Technical skills refer to the ability to implement the processes of risk management (Marx & de Swardt, 2019). Standards for risk management, such as ISO 31000, set guidelines for integrated risk management, but the effectiveness of implementing standards varies from manager to manager.

  • Smart city concept understanding: The risk manager should be able to see the big picture in the smart cities’ concept. Knowledge of the key objectives of smart cities, the stakeholders and the factors that create uncertainty are necessary to be known, in order to manage the emerging risks.

  • Project management skills: Tasks such as creating timelines, long-term planning and setting budget are included in project management procedures. These tasks will be used either directly or indirectly in the risk management procedure too.

  • Soft skills: Building the right team, effective cooperation with all its members, effective transmission of information, wise judgement and communicating the risk management procedures to external stakeholders are just some of the soft skills that a risk manager may need (Carvalho & Rabechini Junior, 2015). This means that technical skills alone are not sufficient for successful risk management.

Competence in statistics: The risk manager will be required to use a significant number of mathematical models, simulations and statistics to analyse risks. For example, quantitative analysis follows risk identification and is used to express the probability of occurrence and consequences of identified risks in mathematical form (Baker et al., 1998). This analysis allows the comparison of risks in order to derive a priority for dealing with them, as the budget for this purpose is not limitless.

5.2 Risk Mitigation Strategies

It is necessary to develop appropriate risk response strategies to address the risks that threaten the existence of smart cities. This purpose is served by risk response strategies which address the causes, likelihood and consequences of risks, before or after their occurrence. PMI suggests as risk response strategies: avoidance, transfer, mitigation and acceptance. Definitions of each one are (Project Management Institute, 2017):

  • Avoidance: “eliminate the threat or protect the project from its impact”.

  • Transfer: “shifting ownership of a threat to a third party to manage the risk and to bear the impact if the threat occurs”.

  • Mitigation: “reduce the probability of occurrence and/or impact of a threat”.

  • Acceptance: “acknowledges the existence of a threat, but no proactive action is taken”.

First of all, cyberthreats could be assessed by training the personnel responsible for data management, for cyberattacks (Sheehan et al., 2021). Such a measure would help in avoiding potential errors that would create breaches in the smart systems for hacker attacks. Moreover, equipping city’s personnel with cyber-attack assessment skills and knowledge would create one more layer of safety from such risks. Finally, since every sector of city is operating in smart technologies, it is not enough to train IT staff, but equipping all staff with good practices in operating technology systems is essential (Kitchin & Dodge, 2019).

Transfer strategy is served by cyber insurance companies, for example, in cyber-security issues, the number of which is increasing not only because of the growing need for their services but also because of legal considerations (Sheehan et al., 2021). By exploiting such excesses, the city is relieved of the cost of a cyberattack.

In case of data storage, encrypting data stored in clouds could prevent their retrievement, even if the attacker succeeded accessing in the cloud (Krämer et al., 2019). Also keeping backups for the important data would eliminate the losses of their potential delete by hackers. Finally, as mentioned before, decentralization of data management by city’s sector would avoid exposing all city’s data to the attackers. Each one strategy would reduce the impact of a breach of the databases.

There is however another evolving tool for avoiding the vulnerabilities of databases called blockchain. Blockchain is a decentralized storage technology which was initially developed for cryptocurrency transactions and then adopted for other applications, as in smart cities too. The key features of blockchain that make it suitable for replacing databases, as they are known today, are decentralization, resistance to cyberattacks, transparency and scalability (Bhushan et al., 2020; Cui et al., 2018).

Another example, which this time would address the possibility of the risk occurring, is the introduction of standards when creating smart systems in terms of security, encryption, verification and other factors (Sengan et al., 2020). By setting standards, no technology will fall short of safety measures, and the probability of data breach would be reduced. This fact is of crucial importance as in interdependent technological systems, their overall security is equal to the security provided by the weakest component (Kitchin & Dodge, 2019).

Standards can be applied not only to the technologies to be included in smart cities but also to the companies involved. Companies in smart cities are an extension of cities, as they generate, manage and move data to and from city services. Therefore, no matter how many measures the smart city takes for potential risks, it will remain vulnerable to the security flaws of the partner companies. For this reason, it is proposed in the literature that companies that want to participate in the smart city environment should commit themselves to following the standards that have already been developed and which deal with data ownership issues and security procedures for data protection (Vitunskaite et al., 2019).

Artificial intelligence (ΑΙ) is a crucial tool for managing data and countering cyberattacks at the same time. By utilizing the machine learning capability of AI applications, these applications are able to identify patterns for optimal data management (Bellam, 2018). The same pattern recognition capability can be also used to identify cyber-attack patterns, while its self-learning capacity offers the ability to anticipate new cyber-risks (Srivastava et al., 2017). For the autonomous assessing of cyberthreats by AI, algorithms have already been developed and analysed in the literature, such as the neural network model (Krundyshev, 2020).

To extract data from the physical environment of the city and convert it into digital data, the deployment of a plethora of sensor nodes within the smart city is essential. The number of those makes it impossible to check their functionality and reliability in hardware and software level by physical testing. For this cause, dynamic trust measurement models have been developed and tested (Gong et al., 2018). Such measurement models consist of algorithms for the production and evaluation of the signatures of the nodes and for their comparison with trusted nodes (Gong et al., 2018).

Another measure to counter cyberattacks is to keep IoT devices and systems up to date (Andrade et al., 2020). The methods and means for cyberattacks are also evolving rapidly. Therefore, neglecting to upgrade the software used in the smart city environment will create vulnerabilities, as the systems will be outdated against the advances in attack methods.

Risks such as cyberattacks, private information and data disclosure or information systems’ errors are often dealt by using other technological systems and automations. This fact raises new issues, as in studies the technologies are often the problem that generates a risk and not the means to solve it (Soyata et al., 2019). Consequently, the situation as it stands at present gives the impression of a vicious cycle. For this reason, but also because new technologies are being integrated and their complexity increases in each smart city, it is necessary to constantly reassess and identify new risks. Risk management is a process that follows the whole lifecycle of a smart city.

6 Conclusions

The number of smart cities is growing rapidly, a trend driven by changing conditions and needs within cities. Along with smart cities, the number of stakeholders who are required to participate in, adapt to and take decisions is growing. In decision-making both in the process of designing smart cities and in their operation, a risk management plan is necessary to ensure the sustainability of the endeavour. Risk management is becoming a complex process, similar in complexity to the interaction of the technologies that build smart cities.

This chapter aims to familiarize developers, managers and other stakeholders of smart cities with the risks to which smart cities may be exposed. Lack of risk awareness will threaten the existence of the smart city in the future, as these risks emerge. Identifying them is therefore the first step in addressing them.

In order to identify the risks that affect the design and operation of a smart city, an SLR was conducted, while the results were presented as PRISMA guidelines suggest. From the SLR the following categories of risks have been identified, (1) economic, (2) social, (3) organizational, (4) environmental, (5) technological and technical, (6) strategic, (7) political, (8) legal and (9) security, with their subcategories presented in detail in Table 3.

For the effective implementation of risk management, risk managers need to be qualified with certain skills and competences. Such skills are technical skills, smart cities’ concept understanding, project management skills, soft skills and mathematical skills. In addition to their personal skills, risk managers can use strategies that have already been developed to mitigate risks. Particular emphasis is given in the literature to address security risks, as the direct and indirect protection of citizens is a priority for any smart city. Following the avoidance, transfer and mitigation strategies and by utilizing new technologies, a number of methods are presented.

One potential limitation of this study is the bias of the researchers on the naming of risks, the grouping of common risks and finally their categorization in the RBS. To address this, detailed reviews were carried out by all researchers, and lengthy discussions were held. As in every RBS, the researchers may differentiate the final result; however, it is the authors’ belief that the information (i.e. risks appearing in the RBS) is complete and accurate.

The generated RBS for smart cities’ risks could be an advisor in identifying the risks that smart city managers will be asked to undertake. Moreover, high-level strategies are presented, as addressing methods of the identified risks. The equipment of those actively involved in smart cities with risk management skills and knowledge for risk mitigation strategies is an essential step to ensure the sustainability of smart cities from the top level of their management.