Security Impact Assessment Measures

SIAM

Innovation Journey Report

Dissemination Level: Restricted to the European Commission and Consortium Partner

Deliverable D 2.6

Innovation Journey Report

Centre for Technology and Society Project number Dr. Leon Hempel 261826

Lars Ostermeier Call (part) identifier Tobias Schaaf FP7-Security-2010-1

Dagny Vedder Funding scheme Collaborative Project D r . S e r gio Olivero

Massimo Migliorini

Roberta Sabbatelli

Content 1. Introduction ...... 6

1. Innovation Journey Approach ...... 7

1.1 Idea of the innovation journey ...... 7

1.2 Security technology assessment processes ...... 7

1.3 Security Measure Technology Typology ...... 9

2. Research Strategy ...... 13

2.1 Description of the case study: Turin Metro, Italy...... 13

2.2 Data sources ...... 14

2.3 Data analysis ...... 14

2.4 Security technologies overview ...... 15

2.5 Security Sensitivity Areas Description ...... 16

3. Innovation Journey: Detection Technologies ...... 19

3.1 Technological functionality ...... 19

Fibre Laser Sensors [acronym: FBL] ...... 19

Smoke detectors and fire protection system [acronym: SMD] ...... 20

3.2 Security Sensitivity areas involved ...... 20

Fibre Laser Sensors [acronym: FBL] ...... 20

Smoke detectors and fire protection system [acronym: SMD] ...... 20

3.3 Actors of the innovation journey ...... 21

3.4 Promises, expectations and interests of actors ...... 22

Fibre Laser Sensors [acronym: FBL] ...... 22

Smoke detectors and fire protection system [acronym: SMD] ...... 23 Page 2 of 75

3.5 Obstacles during the innovation journey ...... 25

Fibre Laser Sensors [acronym: FBL] ...... 25

Smoke detectors and fire protection system [acronym: SMD] ...... 25

3.6 The role of legislation ...... 26

Fibre Laser Sensors [acronym: FBL] ...... 26

Smoke detectors and fire protection system [acronym: SMD] ...... 26

3.7 Technological Choice: Conclusion of the innovation journey results ...... 26

Fibre Laser Sensors [acronym: FBL] ...... 26

Smoke detectors and fire protection system [acronym: SMD] ...... 26

4. Innovation Journey: Surveillance Technologies ...... 27

4.1 Technological functionality ...... 27

Close Circuit Television [acronym: CCTV] ...... 28

SCADA Systems (Supervisory Control and Data Acquisition) [acronym: SCADA] ...... 28

4.2 Security Sensitivity areas involved ...... 29

Close Circuit Television [acronym: CCTV] ...... 29

SCADA Systems (Supervisory Control and Data Acquisition) [acronym: SCADA] ...... 29

4.3 Actors of the innovation journey ...... 30

4.4 Promises, expectations and interests of actors ...... 31

Close Circuit Television [acronym: CCTV] ...... 31

SCADA Systems (Supervisory Control and Data Acquisition) [acronym: SCADA] ...... 33

4.5 Obstacles during the innovation journey ...... 34

Close Circuit Television [acronym: CCTV] ...... 34

SCADA Systems (Supervisory Control and Data Acquisition) [acronym: SCADA] ...... 34

4.6 The role of legislation ...... 34 Page 3 of 75

Close Circuit Television [acronym: CCTV] ...... 34

SCADA Systems (Supervisory Control and Data Acquisition) [acronym: SCADA] ...... 34

4.7 Technological Choice: Conclusion of the innovation journey results ...... 35

Close Circuit Television [acronym: CCTV] ...... 35

SCADA Systems (Supervisory Control and Data Acquisition) [acronym: SCADA] ...... 35

5. Innovation Journey: Identification Technologies ...... 37

5.1 Technological functionality ...... 37

Radio-frequency identification (RFID) ...... 37

5.2 Security Sensitivity Areas involved ...... 38

5.3 Actors of the innovation journey ...... 38

5.4 Promises, expectations and interests of actors ...... 39

5.5 Obstacles during the innovation journey ...... 42

5.6 The role of legislation ...... 42

5.7 Technological Choice: Conclusion of the innovation journey results ...... 43

6. Innovation Journey: Information Processing & Communication Technologies ...... 44

6.1 Technological functionality ...... 44

Internal Radio Network [acronym: RAD] ...... 44

6.2 Security Sensitivity Areas involved ...... 44

6.3 Actors of the innovation journey ...... 45

6.4 Promises, expectations and interests of actors ...... 46

6.5 Obstacles during the innovation journey ...... 48

6.6 The role of legislation ...... 49

6.7 Technological Choice: Conclusion of the innovation journey results ...... 50

7. Innovation Journey: Intrusion Protection & Defence Technologies ...... 52 Page 4 of 75

7.1 Technological functionality ...... 52

7.2 Security Sensitivity areas involved ...... 53

Véhicule Automatique Léger [acronym: VAL] ...... 53

Platform screen doors [acronym: PSD] ...... 53

7.3 Actors of the innovation journey ...... 54

7.4 Promises, expectations and interests of actors ...... 55

Véhicule Automatique Léger [acronym: VAL] ...... 55

Platform screen doors [acronym: PSD] ...... 56

7.5 Obstacles during the innovation journey ...... 59

Véhicule Automatique Léger [acronym: VAL] ...... 59

Platform screen doors [acronym: PSD] ...... 59

7.6 The role of legislation ...... 60

Véhicule Automatique Léger [acronym: VAL] ...... 60

Platform screen doors [acronym: PSD] ...... 60

7.7 Technological Choice: Conclusion of the innovation journey results ...... 60

Véhicule Automatique Léger [acronym: VAL] ...... 60

Platform screen doors [acronym: PSD] ...... 60

8. Bibliography ...... 63

9. Appendix: Interview Guideline ...... 65

Page 5 of 75

1. Introduction Work package two consists of two different procedures in order to get some regime knowledge into the assessment support system. On the one hand, local knowledge was collected through in-depth interviews in each case study with local security experts about the evolution of security technologies and measures from their first promises to their current practices of application. On the other hand, global knowledge was reconstructed through in-depth literature analyses and expert interviews with stakeholders, scientists and producers (see deliverables D 2.1, D.2.2).

For the first path of inquiry, whose results are presented in this report, it was particularly important to document the decision making process and to analyze the relevant assessment criteria and questions during the innovation journey. Beside this, obstacles and the legal framework and how they shaped the technologies and finally the counter infringement technologies have been analyzed. All in all, the combination of global and local knowledge leads to an extensive view on different types of security measure technologies (SMTs) and gives some insight into the assessment criteria of actors. These results provide the empirical basis for the assessment support system and will answer the questions “who are the expected assessment support system users” and “what questions will the assessment support system be required to support” as well as “in which innovation phase should the assessment support system be useful”.

In order to reconstruct the innovation journey the following procedure is chosen for this report. First of all, the innovation journey approach is described by defining the idea of the innovation journey and the proceeding assessment activities of actors as well as the used security measure technology typology. Afterwards, the research strategy is explained encompassing the description of the case study, the used data sources and data analysis. Based on the regulative framework the security areas of the airport and involved actors are mapped. The perspective of the passenger within the innovation process is explicitly not included in the innovation journey report, due to the fact that the work package four “regime interaction and freedom infringement” will cover that. In the main part, the innovation journey differentiated by technology types will be reconstructed. For this purpose, first of all the technological functionality and the local position of the investigated technology is introduced. Secondly, the actors that are involved in the innovation journey are presented with their tasks and responsibilities as well as their interests, expectations and promises linked to the technology. Furthermore, the occurred obstacles and the role of legislation are explained. Finally, a conclusion of the main findings will give some insights into which questions have been posed by which actors and which assessment criteria have been used in which innovation phase in order to make the decisions.

Page 6 of 75

1. Innovation Journey Approach

1.1 Idea of the innovation journey

The term innovation journey refers to the work of Van de Ven et al., which focuses on “how changes in innovation ideas, outcomes, people, transactions, and contexts unfold over time” (Van de Ven et al., 2000, p. 7).

Van de Ven et al. separate themselves from other approaches, which interpret the evolution process of a technology as a linear process, where the technology follows a certain path or technological trajectory and shows a momentum of its own, which is inevitable and not influenceable by other actors (Dosi, 1988). Furthermore, the innovation journey is not a phase model following an own logic and time sequence, where the evolution starts with basic research, goes on with applied research, development and finally innovation (Schumpeter, 1942). All these approaches assume that technology development is more or less independent from social forces and predominately technology driven; only researchers are controlling and shaping the content of research, manufacturing only belongs to technicians and consumers are only passive actors (Moors, Rip, & Wiskerke, 2004, p. 35).

For Van de Ven et al. the innovation journey is a non-linear process taking place in recognizable phases (Van de Ven et al., 2000). The innovation journey is neither stable, predictable and stochastic nor random. There are shifts, some things don´t work out, something is tried again. Therefore, the process diverges into multiple, parallel and interdependent paths of activities, setbacks are frequently encountered. The innovation journey consists of the numerous activities and decisions made by many different actors with changing goals, expectations and assessment criteria over the time (Van de Ven et al., 2000). Enabling and constraining effects are influencing the activities of the actors. Thus, the outcome of the evolution process is uncertain, even though actors try to influence and shape the technology development according to their objectives (Rip & Schot, 2002).

1.2 Security technology assessment processes

In order to reconstruct the innovation journey technology development has to be seen as co-evolutionary process between technology and society. A technology is not given, but rather the result of many in process assessment activities of different actors during the invention, implementation, adoption and diffusion phase (Rip & Schot, 2002). The assessment activities of actors decide, which questions are asked and what answers are given and what aspects are emphasized and analyzed. They decide whether actors want to promote or constrain a certain technology. In other words, the assessment activities enact realities of technologies, which again react and influence the activities of the actors. Over

Page 7 of 75

time the assessment activities lead to emerging irreversibility and it gets increasingly difficult for the actors to change the chosen way.

Actors are using different criteria in order to assess the technology. These criteria are influenced by the expectations and promises that actors express during the innovation journey and by the personal interests and objectives regarding the technology (Van Lente & Rip, 1998). Besides that, the obstacles can change the actor’s perception of the technology and the legal framework constrains the activities of actors. All these aspects shape the actor’s frame of reference, which defines the chosen assessment criteria, their questions and answers concerning the acceptance, security efficiency, economic and legal compliance aspects of a certain technology (Garud & Ahlstrom, 1997). Therefore, assessment processes must be seen in context considering the whole range of influencing aspects. There are many in process assessments by many different actors at the time, whereby actors can change their assessment criteria and interests (Van Langenhove & Bertolink, 1999) .

The concept of the innovation journey (Van de Ven et al., 2000) describes the whole life cycle of a technology, starting with the first idea of developing a technology, going on with research and development activities, followed by the adoption and standardisation. During the innovation journey there are certain moments for influencing the dynamics of technology development, where actors intervene and contribute their perspective to the decision making process (Rip & Schot, 2002). In this report we want to focus on the acquisition process of a new technology to an existing infrastructure as one point of influence. According to the typical innovation assessment activities of actors four phases can be identified within the acquisition process, which may appear sequentially, but always with feedback and feed-forward loops (Rip & Schot, 2002).

Concept/ New Option Based on assessments, the concept/new option phase starts either with the identification of a new technological option or with the need or pressure for a new technology to meet a certain problem. During that phase technologies only exist as an idea combined with high expectations about the performance qualities and their efficiency in countering threats and reducing risks. Different actors are interested in influencing the technology development. For this purpose they are mobilizing resources), articulating demands and building networks in order to adapt the technology. Concerning the analysis of the security technology assessment process it is important to answer the question why a certain technology is selected by whom for further developments. Testing/ Development During the testing/development phase different assessment criteria are used to evaluate the technology performance. Pilot tests in the existing infrastructure are conducted and give some insights about the compatibility and performance of the technology. At this stage various problems occur, which leads to a sobering phase after the big promises in the

Page 8 of 75

concept phase. Furthermore, learning processes under time pressure occur. The central question here is how the technology is assessed by the decision makers and which criteria have been used for the testing and development. Adoption/ Diffusion After a phase of testing and problem solving, the technology is introduced to the infrastructure. The adoption of a new technology contains a connection to the existing technology: as a replacement, an addition or an integration in existing processes. At this time, the technology has to demonstrate its reliability and system compatibility. The relevant questions are “who is deciding at which time the technology is adapted” and “what assessment criteria are relevant for the decision”. Sustainment/ Wider Change In the sustainment/wider change phase the new technology becomes an existing standard without any open questions while economies of scale and scope of the new technology are explored and actors are engaged in promoting the technology. Furthermore, possibilities for expandability are identified and tried to be realized. The questions here are “who is defining new possible expendabilities” and “which assessment criteria are used”.

1.3 Security Measure Technology Typology In order to categorize the investigated technologies, a technology typology and later a security measure technology typology was developed by the Technical University Berlin and Kingston University. The first typology is based on the technologies´ functionality in order to provide security. After the first case study interview results and literature overview, conducted by University of Kassel, five types of technologies have been identified: Detection Technologies Detection technologies are used to detect explosives, toxic gases, radiological substances, hazardous objects and drugs for the purpose of the protection of the infrastructure and persons as well as the control of goods and border protection. Surveillance Technologies Surveillance technologies serve as a tool for locating, tracking or tagging people or goods in order to identify for example unattended luggage, unusual events or unusual behaviour of persons. Identification Technologies Identification technologies are used either to identify goods (origin, content, place of destination etc.) or to identify individuals (name, address, date of birth etc.).

Page 9 of 75

Information Processing and Communication Technologies Information processing and communication technologies store or process personal information and/or supports communication. Intrusion Protection and Defence Technologies Intrusion protection and defence technologies support the physical protection from intrusion and defence against immanent attacks.

The first categorization provided the basis for the security measure technology (SMT) typology as it defines five different technology functionalities that are useful in order to describe a technology as a tool. According to the SMT typology the technologies´ intended functionality is only one part within the interplay between actors, activities and tools. In this sense a technology could be used for various activities of different actors in order to implement some part of a security measure. All in all six SMTs have been defined by Kingston University1:

SMT

Identification Enforcement

Physical Situation

Access Awareness Screening Risk Assessment

Figure 1 Security Measure Typology

Identification

Establishing access rights to different areas within a transport facility depends on correctly recognising an individual. Such areas include airside, car parks, trains or airplanes. Individuals such as passengers and employees will have different access rights to different areas and different mechanisms for establishing these rights e.g. employee cards or passports. The three main approaches to identify can be broadly characterised as what you are (i.e. biometric-based such as iris recognition), what you have (i.e. token-based such as passports) or what you know (i.e. knowledge-based such as passwords).

1 See deliverable 2.3 (Kingston University)

Page 10 of 75

Physical access

Segregation of different user groups and objects is a standard security mechanism for preventing unauthorised access to security-sensitive areas, protecting the security integrity of individuals or objects which have passed the checks carried out during a security process, and maintaining the reliability and performance of security measures e.g. by controlling the flow rate of individuals or objects to security sensitive areas or other security measures. Physical Access SMTs relate to the broad category of access technologies such as stationary physical barriers, turnstiles, perimeter fencing, and automated car park barriers that establish such segregation.

Screening

Screening is a security measure for identifying possible dangerous or illegal objects and substances such as weapons, drugs, or explosives. By far the most visible Screening SMTs are those involved in screening passengers and their hand luggage at airports. In fact all security staff, airport staff and air crew also must be screened. In addition to people all hand luggage, baggage, cargo, mail, as well as in-flight meals are screened. Just as all airside deliveries such as retail stock, fuel, and equipment as well as the vehicles used to deliver these. Screening is also routinely used on vehicles at UK ports. Although screening technology is primarily used to detect weapons, drugs and explosives, the detection of people in people trafficking contexts is also increasing. Screening technologies are characterised by who or what they screen (the target of scrutiny, e.g. people or luggage) and what they are screening for (i.e. the target of detection such as weapons, explosives or drugs).

Risk assessment

Risk Assessment SMTs are used in security measures designed to minimise or assess the risk of a threat. This includes profiling methodologies such as background checks of passengers and asymmetric screening based on demographic information, as well as CCTV systems that spot suspicious behaviour.

Individuals and Objects Advance Passenger Information is used to perform generic background checks such as searching no-fly lists. Typically these tests are performed before the passenger arrives at the airport. Profiling uses racial, age, gender and ethnicity clues to select passengers for different types or levels of screening. An alternative is behavioural profiling, during which the behaviour clues as well as responses to probing questions can be used to identify potentially dangerous individuals2.

2 An example of risk control SMTs which performed no target-specific risk assessments could include processes that ensure the unpredictability of security measures, for example, by random selection of passengers for more thorough search.

Page 11 of 75

Situations These range from relatively simple sterile zone applications to complex suspicious or anomalous behaviours detection. Suspicious behaviour technology which is largely based on CCTV data includes abandoned luggage, fighting or simply the flagging of atypical behaviours. ANPR technology can also be used to identify suspicious vehicles i.e. stolen or without appropriate licence, insurance or tax certification.

Situation awareness

Situation Awareness SMTs includes the use of CCTV (increasingly employing PTZ cameras3) to monitor an environment and liaise with staff on the ground. Other technologies may include asset management solutions, such as RFID tags and readers, which are increasingly used to track baggage and passenger movements around the airport, or different kinds of alarm systems which are used to make passengers and/or relevant actors aware of a threat.

Enforcement

Measures for enforcing security exist in at least two different contexts. On the one hand, they ensure compliance with security processes, for example if a passenger attempts to bypass hand luggage screening. Secondly, they are used for responding to actual threats already in progress and for protecting any assets potentially endangered.

The use of enforcement SMTs will usually be defined by a threat assessment element that determines the nature and proportionality of the response, depending on the assessed severity of the threat. Exemplary responses and related technologies include (1) confining or delaying, e.g. automatic locks, bulkhead doors, (2) monitoring of an individual by a guard in person or via the CCTV system, (3) intervening or apprehending, e.g. audible warning signals, compliance warning messages, armed guards, (4) denying access to assets, e.g. electronic keypads which get automatically disabled after the repeated use of a wrong code, or (5) denying use of assets, e.g. fingerprint scanners on weapons or auto-destruct functionality.

3 Steerable pan, tilt and zoom (PTZ) cameras linked to a security control centre

Page 12 of 75

2. Research Strategy

2.1 Description of the case study: Turin Metro, Italy.

In 2006 Italy’s first automatic driverless underground with a VAL system was opened in Turin. The system was designed to meet two major requirements:

- a real-time security management of passengers on board - a security post-analysis of events.

From the earlier design stage of Turin Metro, great emphasis was put on the flexibility of the underground’s security system: there is a wide number of security technologies are embedded in Turin Metro, including video-surveillance systems and RFID readers. In the last five years the number of metro users increased from 30000/day to 150000/day, and in the future the size of Turin Metro is planned to be extended to four times its size: this will likely imply greater security challenges to deal with. Behind each decision concerning the security of a mass transport facility lies a “security concept”, that represents the most important driver to define which technologies can be used, where and how can be installed, and which is the necessary redundancy level (for example, the number of monitoring points). During the interviews specific sessions have been done with the aim to map the security concept embedded in security decisions-makers perspective. The major objective that lies behind the integration of a security technology is the capability to grant the highest level of security of all the people involved (passengers, workers, guards, providers, maintenance personnel, etc.). In particular, it is believed that a person feels “secure” when:  can have a wide and clear visual perception of surrounding environment (this underlines the importance of wide spaces and of powered light systems);  can immediately communicate with other people, to ask help or assistance (this underlines the importance of communication technologies, such as inter-phones or Wi-Fi networks that enable the use of mobile phones on trains and stations);  knows he/she is being observed by other people (i.e. guards, CCTV control center staff, etc.);  feels comfortable environmental conditions (temperature, relative humidity);  does not hear strange or excessively high noises;  does not notice evidences of vandalism (paintings on walls and/or trains, broken devices, etc.);  can not feel “near” any form of danger;  notices regular and frequent trains’ passages;  is hosted in protected spaces, like “compartmented” coaches; From the perspective of who is in charge of managing security technologies, the concept of security embraces also the knowledge of (or the possibility to forecast) each possible status in which a technological system may evolve. An adequate mass transport management must be able to guarantee a reliable and continuous service, to assure an adequate level of people security and Page 13 of 75

systems efficiency, to perform a correct maintenance of all technical devices, to create an adequate training structure for security personnel, to persuade citizens in using an underground and automated public transport system. These aspects represent the mosaic-tiles of Turin Metro security concept, and the theoretical basis to start the Innovation Journey analysis of the different security technologies embedded into this case study.

2.2 Data sources In Turin Metro case study data have been collected through in-depth interviews with security reference personnel. A special attention has been paid during the interviews in granting an adequate balance between the profiles of security experts, in terms of competences, roles and responsibilities. The most relevant fields of activity of the interviewed people can be resumed as following:  technological innovation projects in the field of ICT, video-surveillance, security and info- mobility;  physical security of passengers inside trains and stations;  communication systems & video-surveillance systems;  maintenance of stations control systems;  design of security & safety systems (fire sensors, environmental monitoring systems, air ventilation systems, lifts, etc.);  trains maintenance programs;  quality of metro-related services;  events, advertising and press communications (e.g. opening of new train lines, temporary interruption of services. etc.).

2.3 Data analysis

On the basis of data collected from the interviews, a report has been produced. Firstly, Turin Metro Security Technologies (ST) are described and classified on the basis of the Technologies Typologies, according to SIAM project guidelines. Secondly, security Sensitivity Areas are described and linked with embedded security technologies. Finally, Innovation Journey method is applied to ST and the results discussed.

The results of Innovation Journey Analysis were discussed with Turin Metro during a Workshop held in Italy the 16th December of 2011.

Page 14 of 75

2.4 Security technologies overview In this section the technologies taken in consideration within the Innovation Journey are listed and categorized on the basis of the Technologies Typologies, according to SIAM project guidelines4.

Detection Technologies  Fibre Laser Sensors [acronym: FBL]  Smoke detectors and fire protection system [acronym: SMD]

Surveillance Technologies  Close Circuit Television [acronym: CCTV]  SCADA Systems (Supervisory Control And Data Acquisition) [acronym: SCADA]

Identification Technologies  Smart RFID Card [acronym: RFID]

Information Processing & Communication Technologies  Internal Radio Network [acronym: RAD]

Intrusion Protection & Defence Technologies  Automatic Light Vehicle system [acronym: VAL]  Platform screen doors [acronym: PSD]

4 see “SIAM project, Deliverable 2.1”

Page 15 of 75

2.5 Security Sensitivity Areas Description In compliance with Italian Regulation DM 11/1/88, Turin Metro contains five categories of security sensitivity areas: 1) Public area

Figure 2 Public area

The area embraces the paths between the external part of the metro stations (i.e. the stairs to the road) and the check-points for passengers tickets (not including them). The area does not present any access restriction for people.

2) Internal area

Figure 3 Internal area

The area ranges from the check-points for passengers tickets to the trains waiting platforms. The border between this area and the trains is represented by a high-tech barrier installed to avoid people to reach the high-voltage tracks or the technical rooms located below the railroad.

Page 16 of 75

3) Technical rooms

Figure 4 Technical rooms

Under railroad tracks and next to trains waiting platform there are several technical rooms hosting ICT systems, video-surveillance control monitors and other technical devices. These rooms are secured and accessible only to restricted personnel.

4) Trains

Figure 5 Trains This area refers to the space inside the trains. The border of this area, as previously mentioned, is a high-tech barrier installed to avoid unauthorized accesses.

Page 17 of 75

5) Tunnels

Figure 6 Tunnels

The Tunnels area and the ventilation shafts, including the rooms for train maintenance located inside.

6) Security Headquarter

Figure 7 Security headquarter The Security Headquarter, in a independent location from metro infrastructures, is the strategic center of security management for Turin Metro. In this area security policies, protocols, procedures, systems and actions are defined, and remote monitoring and control systems data are analyzed and stored. The Headquarter hosts a series of offices, train maintenance facilities and security remote control rooms.

Page 18 of 75

3. Innovation Journey: Detection Technologies In the case study of Turin Metro the following Detection Technologies has been recognized:  Fibre Laser Sensors [acronym: FBL]  Smoke detectors and fire protection system [acronym: SMD]

3.1 Technological functionality In the following table SMTs types that technologies address are showed.

Identificati Physical Screening Risk Situation Enforcement on Access Assessment Awareness FBL x x SMD x x Chart 1 Detection technologies, technological functionality Fibre Laser Sensors [acronym: FBL] Fibre Laser is a laser technology which uses optical Fibres doped with rare-earth elements such as erbium, ytterbium, neodymium, dysprosium, praseodymium, and thulium [10]. Applications of fibre lasers include mass transport security/safety, material processing, telecommunications, spectroscopy, and medicine. In Turin Metro, Fibre Laser technology is used to detect anomalous heat increasing on train lines. From security point of view, Fibre Laser sensors allow mitigating impacts of sabotages or vandalism/terrorism actions; as far as concerns safety, FBL technology can early-warn fires coming from accidents or systems failures. Turin Metro FBL system is based on two Fibre optical rings on the tracks along stations that are connected on control units. These units periodically send a pulse signal. If a problem occurs, the pulse signal is modified by the higher temperature and the fire protection system is activated. The sprinkler is usually without water and closed by ceramic bulks. The bulks open only at a temperature of 60°C to optimize the water pressure where needed. Fibre Laser sensors have been taken into considerations in the early phase of Turin Metro design, with the specific purpose to detect possible heat concentration along the train line. Fibre Laser sensor has been related to Situation Awareness category since its main functionality is to continuously monitor railway ground temperatures and to identify and warn potential fires in trains or tunnels. It has been associated to Enforcement category as well since there are a number of active control systems that can be triggered depending on FBL warnings (sprinklers, ventilation systems, doors closing/opening, light & sound signals, etc.).

Page 19 of 75

Smoke detectors and fire protection system [acronym: SMD] A smoke detector is a device that detects smoke, typically as an indicator of fire. George Andrew Darby patents the first electrical Heat detector and Smoke detector in 1902 in Birmingham, England [11]. In the late 1930s the Swiss physicist Walter Jaeger tried to invent a sensor for poison gas. He expected that gas entering the sensor would bind to ionized air molecules and thereby alter an electric current in a circuit in the instrument. His device failed: small concentrations of gas had no effect on the sensor's conductivity. Frustrated, Jaeger lit a cigarette, and was soon surprised to notice that a meter on the instrument had registered a drop in current. Smoke particles had apparently done what poison gas could not. Jaeger's experiment was one of the advances that paved the way for the modern smoke detector. Nowadays smoke detectors are largely used in mass transport, commercial, industrial, and residential systems. In Turin Metro Smoke Detectors are installed on the external chassis of the trains, creating a “movable” detection system able to monitor tunnels and quickly react in case of problems. Fire protection system allows the segmentation of the areas between tunnel and platforms to avoid the propagation of fire between different areas. SMD has been related to Situation Awareness category since its main functionality is to continuously monitor the presence of smoke on railway environment and to identify and warn potential fires in trains or tunnels. It has been associated to Enforcement category as well since there are a number of active control systems that can be triggered depending on SMD warnings (sprinklers, ventilation systems, doors closing/opening, light & sound signals, etc.).

3.2 Security Sensitivity areas involved Fibre Laser Sensors [acronym: FBL]

Trains Tunnels The Fibre Laser sensor (FBL) is mainly installed on the railways tracks.

Smoke detectors and fire protection system [acronym: SMD]

Public Area Internal area Technical rooms

Trains Tunnels Security Headquarter SMDs are typically located on the walls in every area accessible to personnel or containing electrical devices.

Page 20 of 75

Public Area Internal Technical Trains Tunnels Security Area rooms Headquarter FBL x x SMD x x x x x x Chart 2 Security Sensitivity areas involved

3.3 Actors of the innovation journey A number of Stakeholders took part in the decision processes regarding FBL and SMD technologies:  Security Committee for Turin Metro systems, with the task to assess proposals for technological improvements of Turin Metro.  USTIF, local division of Italian transport Ministry, with the task to validate testing results of new technologies for Turin mass transport systems.  Fire Department of Turin, with the task to prevent/deal with fires danger, in particular for new technological systems.  Industrial providers that supply technical systems/devices and perform maintenance services for technological systems.  Turin Municipality, with the task to plan an adequate mobility for Turin City and granting the security and welfare of Turin people.  Police department of Turin, with the task to prevent criminal actions and protect people also by guaranteeing an adequate level of transports security.  Turin Metro users that are mainly the population of Turin and neighbour cities, with the task to use Turin transport system and provide feedback on their satisfaction level.  Turin metro personnel (either technicians or managers), with the task to guarantee the functionality of Turin Metro Systems.  Other local Authorities (civil protection, red cross, category associations, etc.) with the tasks to guaranteeing people health, security, mobility and freedom.

Page 21 of 75

Chart 3 Actors

3.4 Promises, expectations and interests of actors

Fibre Laser Sensors [acronym: FBL]

The main expectation Turin Metro had from FBL was to integrate a reliable and efficient system to detect either manmade or accidental fires, in order to increase people security and reduce the likelihood of train systems damaging. A rigid control of the temperature allows also a better maintenance of rail line and related infrastructures (and consequently a more efficient allocation of resources). Beside the reliability and the cost/benefit ratio, other drivers lead to FBL choice: the fine compatibility with already used/planned technological systems; the good feedback on this technology coming from other metros system; the results of preliminary tests session done by Turin Metro personnel (“interview 3, line 6”). FBL technology respected the early expectations of Turin Metro designers, demonstrating to be an efficient system to detect and prevent manmade and accidental fires. The only issue concerning FBL is the more and more growing cost of Fibre material that may lead this technology to become too much expensive in comparison with other possibilities.

Besides, the future of FBL may embrace a series of technical improvements to increase its performances and consequently its competitiveness for Turin Metro. The most likely it seems to be a WI-FI bridge linking the sensors, with the purpose to allow remote centres to directly interact with FBL system.

Page 22 of 75

Smoke detectors and fire protection system [acronym: SMD]

SMD technology, as FBL, was expected to provide an efficient early warning system to detect and prevent manmade and accidental fires. While FBL is used for subway tracks, smoke detectors are installed in stations and on the external chassis of the trains, with the aim to create a “movable” detection system able to monitor tunnels. In the Concept/New Options of SMD, an analysis was done to decide upon the choice of Water Mist system or the Sprinkler system as possible “first response” to smoke detectors signal. Since both the systems showed the same performances, the choice was oriented on Sprinkler system, being it more suitable to Turin Metro maintenance protocols (“Interview 1, line 6”).

The table below describes Turin Metro processes concerned to FBL and SMD technologies and relates them to the respective phases of Innovation Journey method, highlighting the interests of the different actors involved (list not exhaustive).

Page 23 of 75

Ministry (interests: to validate the installation of the selected technology for a pre-operational testing phase).  Turin Metro Personnel (interests: to ensure correct installation and operability of the technology, to integrate the technology with other existing security systems).  Industrial Providers (interests: to adjust/refine the technology to be compliant to Turin Metro systems security requirements).  Fire Department of Turin (interests: to take  Phase 2: part to testing procedures to verify fire Pre-operation testing phase Development/Tes control systems, alarms and communication ting procedures/devices, including emergency communication).  Police (interests: to take part to testing procedures to verify fire control systems, alarms and communication procedures/devices, including emergency communication).  USTIF, local division of Italian transport Ministry (interests: to ensure correct testing sessions and validate its results).  Turin Metro Personnel (interests: to assess technology performances).  Industrial Providers: (interests: to adjust/refine the technology to be compliant to Turin Metro systems security requirements).  Fire Department of Turin (interests: to take part to testing procedures to verify fire Technology performance control systems, alarms and communication assessment, possible technical Phase 2: procedures/devices, including emergency adjustments or related procedures Development/Testing communication). reviewing  Police (interests: to take part to testing procedures to verify fire control systems, alarms and communication procedures/devices, including emergency communication).  USTIF, local division of Italian transport Ministry (interests: to ensure correct testing sessions and validate its results).  Turin Metro Personnel (interests: to ensure Phase 2: correct installation and operability of the Possible additional testing phases Development/Testing technology, to integrate the technology with other systems). Formal validation of the testing  USTIF, local division of Italian transport Phase 3: phase and official authorization to Ministry (interests: to ensure correct Adoption/Diffusion technology utilization testing sessions and validate its results).  Turin Municipality: (interests: to take part Opening of the new technology to Phase 3: to official events, such as opening of new public use Adoption/Diffusion stations/systems, and to participate in organizing communication procedures to

Page 24 of 75

people and local Bodies/Authorities).  Turin Metro Personnel (interests: to organize the opening events of new stations/systems, to participate in organizing communication procedures to people and local Bodies/Authorities).  Turin Metro Users (interests: to express their opinion on new technology through surveys and/or interviews).  Turin Metro Personnel (interests: to monitor the status of Turin Metro systems, to collect information/experiences and to analyse/assess gaps or opportunities).  Industrial Providers (interests: to perform technology maintenance/updating, to propose new releases) Experiences collecting and  Turin Metro Users: (interests: to express Phase 4: analysis of new possible their opinion on possible future Sustainment/Wider change opportunities improvements of Turin Metro systems and services).  Police Department, Turin Municipality, Fire Department and other local authorities (interests: to ask Turin Metro for technologies updating, improvement/refining, or for new technology installations). Chart 4 Actors involved and interests

3.5 Obstacles during the innovation journey

Fibre Laser Sensors [acronym: FBL]

No relevant technical obstacles have been found in FBL integration processes, but some minor technical adjustments were performed during the Testing/Development phase. One problem observed in test sessions was the excessive sensitivity of Fibre material, and the consequent high rate of false alarms. Sometimes happened the alarm was triggered by hot oil drops falling from the train to the tracks. The alarm threshold was adjusted to avoid the risk of false warnings. Since FBL is a “hidden” technology and it does not directly interact with passengers, the level of acceptance was not a relevant issue for the decision maker. Further, FBL is not associated to any specific freedom infringement or privacy issue and no sensible data is recorded by FBL systems.

Smoke detectors and fire protection system [acronym: SMD]

One problem observed in Testing/Development phase of SMD technology was an excessive sensitivity of sensors. The alarm threshold was adjusted to avoid the risk of false warnings that could have reduced the attention level of security personnel. A large number of simulations and tests were done, in order to optimize the security procedures involving SMD and its interaction with

Page 25 of 75

other technological systems, such as AVS for smart ventilation or stations facilities for people traffic managing (speakers, light signals, etc.) The relative low intrusiveness of SMD technology met a good acceptance by people, encouraging a rapid diffusion in Turin Metro systems. This aspect however may change in the future, due to the recent change of some regulations enforcing the periodic control of each sensor instead of only some “spot” sensors. This relevantly increases the effort of SMD maintenance procedures, thus reducing its competitiveness in comparison with other solutions.

3.6 The role of legislation

Fibre Laser Sensors [acronym: FBL]

As FBL is strongly linked with both security and safety, there are a wide number of regulations. Examples can be Italian regulations on fire preventing and fire fighting (such as D.P.R. 12/01/98), the regulations on workers security & safety (“Testo 81”), the regulations on rail tracks maintenance, etc.

Smoke detectors and fire protection system [acronym: SMD] The scenario of SMD related regulations is quite similar to FBL one, being both these technologies strongly linked with fires, so again we find the Italian regulations on fire preventing and fire fighting (such as D.P.R. 12/01/98), the regulations on workers security & safety (“Testo 81”), the regulations on rail tracks maintenance, etc. A significant role for SMD is played also by sanitarian protocols concerning smoke dangers for people (“interview 4, line 8-9”).

3.7 Technological Choice: Conclusion of the innovation journey results

Innovation journey analysis highlighted a series of criteria that strongly influenced decision makers dealing with FLB and SMD technologies. These criteria can be resumed as following:

Fibre Laser Sensors [acronym: FBL] Concept / New Option phase: Ratio cost/benefit, compatibility with other systems, feedback coming from other mass transport contexts.

Testing / Development phase: Sensitivity, reliability.

Adoption / Diffusion phase: Regulations ( Testo 81, - D.P R. 12/01/98 )

Sustainment / Wider Change: False warnings rate

Smoke detectors and fire protection system [acronym: SMD] Concept / New Option phase: Ratio cost/benefit, compatibility with safety systems (such as ventilation)

Page 26 of 75

Testing / Development phase: Sensitivity, reliability.

Adoption / Diffusion phase: Regulations ( Testo 81, - D.P R. 12/01/98), low intrusiveness

Sustainment / Wider Change: Maintenance cost enforced by new regulations

SMT Techn Actors Concept/ Testing/ Adoption Sustainment/ ology New Option Developme / Wider Change nt Diffusion Situation Awareness FBL Security Committee for Ratio cost/benefit Sensitivity Regulations: False warnings rate Enforcement Turin Metro systems - Testo 81 USTIF Compatibility with other Reliability - D.P R. Fire Department of Turin systems 12/01/98 Industrial providers Turin Municipality Feedback coming from other Police Department mass transport contexts Turin Metro users Turin Metro personnel Other local authorities

Situation Awareness SMD Security Committee for Ratio cost/benefit Sensitivity Regulations: Maintenance cost Enforcement Turin Metro systems - Testo 81 enforced by new USTIF Integrability with safety Reliability - D.P R. regulations Fire Department of Turin systems (such as ventilation) 12/01/98 Industrial providers Turin Municipality Low Police Department intrusiveness Turin Metro users Turin Metro personnel Other local authorities

Chart 5 Conclusion of the innovation journey results

4. Innovation Journey: Surveillance Technologies

In the case study of Turin Metro the following Surveillance Technologies has been recognized:

 Close Circuit Television [acronym: CCTV]  SCADA Systems (Supervisory Control And Data Acquisition) [acronym: SCADA]

4.1 Technological functionality

In the following table SMTs types that technologies address are showed.

Identificati Physical Screening Risk Situation Enforcement on Access Assessment Awareness CCTV x SCADA X x x x Chart 6 Surveillance Technologies, technological functionality

Page 27 of 75

Close Circuit Television [acronym: CCTV] Closed-circuit television (CCTV) is intended as a systems of video cameras transmitting a signal to a specific place, on a limited set of monitors. It differs from broadcast television in that the signal is not openly transmitted, though it may employ point to point, point to multipoint, or mesh wireless links. Though almost all video cameras fit this definition, the term is most often applied to those used for surveillance in areas that may need monitoring such as banks, casinos, airports, military installations, and convenience stores. The first CCTV system was installed by Siemens AG at Test Stand VII in Peenemünde, Germany in 1942, for observing the launch of V-2 rockets [9]. CCTV recording systems are still often used at modern launch sites to record the flight of the rockets, in order to find the possible causes of malfunctions. In recent decades, especially with general crime fears growing in the 1990s and 2000s, public space use of surveillance cameras has taken off, especially in many European countries. In the field of transport security CCTV system are typically installed where an operator of a machine cannot directly observe people who may be threaten by unexpected machine operation or criminal events. For example, on a subway train, CCTV cameras may allow the operator to confirm that people are safe from doors before closing them and starting the train after a system warning. A smart CCTV infrastructure is embedded In Turin Metro system, allowing security responsible personnel to perform a wide-range monitoring of stations, trains and other strategic security areas. The system is designed to meet two major requirements: firstly, real-time security management of passengers on board (central control operators can evaluate what is happening on board) and secondly, an analysis of events. The overall system in the first trunk has 534 cameras. All video streams are hardware digitally encoded with MPEG4 algorithm. The video streams from the trains are transferred with a wireless radio transmission protocol, while the video streams from the stations are transferred with an IP/Ethernet optical ring backbone. All the data is real-time transferred in to the two workstations in the Central Control Room with a graphical user interface that allows showing and controlling the images from each of the cameras on a monitor wall featuring displays. A special feature of the surveillance system is the fact that these images can be made available outside of the underground system via an IP LAN link. Real-time videos from and trains have already been transferred to nearby police stations, for instance. CCTV has been related to Surveillance category since its main functionality is to continuously video- monitor railway environment, with the aim to enable security operators to spot suspect/dangerous situations, objects or behaviours.

SCADA Systems (Supervisory Control and Data Acquisition) [acronym: SCADA] The term SCADA (supervisory control and data acquisition) usually refers to centralized systems which monitor/control sites, processes or technical/technological systems. A SCADA normally is composed by a number of subsystems, including: a supervisory computer system, gathering data and sending commands; a

Page 28 of 75

human–machine interface which presents data to a human operator allowing to perform monitoring and control activities; a series of sensors, with remote terminal units connecting to sensors, converting sensor signals to digital data and sending them to the supervisory system; a communication infrastructure connecting the supervisory system to the remote terminal units; a series of programmable logic controllers (typically used as field devices). SCADA systems are used today in a number of application contexts, including mass transport, industrial plants and water treatment infrastructures. In Turin Metro SCADA technology concerns the centralized remote control system used to monitor and manage most of technical devices embedded in trains and stations SCADA has been related to many SMTs category since its main functionality is to provide automated control and management of a series of different security devices with different security purposes (including video-monitor devices, screening devices, enforcement devices such as automated doors, etc.).

4.2 Security Sensitivity areas involved

Close Circuit Television [acronym: CCTV]

Public Area Internal area Technical rooms

Trains Tunnels Security Headquarter

Close Circuit Television cameras are located in every strategic area, with the purpose to enable a wide-perspective security monitoring.

SCADA Systems (Supervisory Control and Data Acquisition) [acronym: SCADA]

Technical rooms Security Headquarter SCADA control centers are mainly located inside local technical rooms near platforms, and the strategic Security Headquarter.

Public Area Internal Technical Trains Tunnels Security Area rooms Headquar ter CCTV x x x X x x SCADA x x Chart 7 Security Sensitivity areas involved

Page 29 of 75

4.3 Actors of the innovation journey

A number of Stakeholders took part in the decision processes regarding CCTV and SCADA technologies:

 Security Committee for Turin Metro systems, with the task to assess proposals for technological improvements of Turin Metro.  USTIF, local division of Italian transport Ministry, with the task to validate testing results of new technologies for Turin mass transport systems.  Fire Department of Turin, with the task to prevent/deal with fires danger, in particular for new technological systems.  Industrial providers that supply technical systems/devices and perform maintenance services for technological systems.  Turin Municipality, with the task to plan an adequate mobility for Turin City and granting the security and welfare of Turin people.  Police department of Turin, with the task to prevent criminal actions and protect people also by guaranteeing an adequate level of transports security.  Turin Metro users that are mainly the population of Turin and neighbour cities, with the task to use Turin transport system and provide feedback on their satisfaction level.  Turin metro personnel (either technicians or managers), with the task to guarantee the functionality of Turin Metro Systems.  Other local Authorities (civil protection, red cross, category associations, etc.) with the tasks to guaranteeing people health, security, mobility and freedom.

Chart 8 Actors

Page 30 of 75

4.4 Promises, expectations and interests of actors

Close Circuit Television [acronym: CCTV]

The concept that a person does feel secure when he knows is being observed by other has been and is a major driver for Turin Metro. CCTV was taken in consideration from the early design stage of Turin Metro, since it represents a „well-known“ veteran technology capable to bring significant improvements in the security of a mass transport and to mitigate a wide number of threats: thefts, vandalisms, physical aggressions, terrorist actions, illicit commerce, etc. CCTV demonstrated to respect all the expectations, although during its Testing/Development phase some minor optimizations were done (see “obstacles”). For what regards the Sustainment/Wider change phase of CCTV in Turin Metro, the adoption of smart systems performing objects tracking and/or seems to be a likely path. In that case, a further attention shall be paid to privacy issues. It is quite difficult to forecast which regulations (and in which way) could influence CCTV in the future, but decision makers are aware that, if objects tracking will be adopted, an assessment of all potential privacy infringements shall be done and the authorization by Italian Privacy Authority shall be requested to analyze CCTV data. Another problem in the near future may come from the installation of new cameras and monitors, since the growing of observation points may lead to a progressive loss of attention by security operators. In this case, the adoption of new promising technologies such as smart cameras with automated behaviour recognition (and object tracking as well) may be a major measure to reduce this risk (“interview 1, line 12”).

The table below describes Turin Metro processes concerned to CCTV technology and relates them to the respective phases of Innovation Journey method, highlighting the interests of the different actors involved (list not exhaustive).

Page 31 of 75

 Turin Metro personnel (interests: to details Technical requirements definition Phase 1: Concept/New technological needs and to write a tender and tender writing Options for industrial providers).  Industrial Providers (interests: to participate and win the tender, to start a systematic provision of security technology Proposals presentation and Phase 1: Concept/New to Turin Metro). assessment Options  Turin Metro personnel (interests: to assess proposals and select the best technological opportunities).  Turin Metro personnel (interests: to enable the installation of the selected technology). Official authorization to the Phase 2:  USTIF, local division of Italian transport installation of the technology for a Development/Testing Ministry (interests: to validate the pre-operational testing phase installation of the selected technology for a pre-operational testing phase).  Turin Metro Personnel (interests: to ensure correct installation and operability of the technology, to integrate the technology with other existing security systems).  Industrial Providers (interests: to adjust/refine the technology to be compliant to Turin Metro systems security requirements).  Fire Department of Turin (interests: to take  Phase 2: part to testing procedures to verify fire Pre-operation testing phase Development/Tes control systems, alarms and communication ting procedures/devices, including emergency communication).  Police (interests: to take part to testing procedures to verify fire control systems, alarms and communication procedures/devices, including emergency communication).  USTIF, local division of Italian transport Ministry (interests: to ensure correct testing sessions and validate its results).  Turin Metro Personnel (interests: to assess technology performances).  Industrial Providers: (interests: to adjust/refine the technology to be compliant to Turin Metro systems security requirements). Technology performance  Fire Department of Turin (interests: to take assessment, possible technical Phase 2: part to testing procedures to verify fire adjustments or related procedures Development/Testing control systems, alarms and communication reviewing procedures/devices, including emergency communication).  Police (interests: to take part to testing procedures to verify fire control systems, alarms and communication procedures/devices, including emergency communication).  USTIF, local division of Italian transport

Page 32 of 75

Ministry (interests: to ensure correct testing sessions and validate its results).

 Turin Metro Personnel (interests: to ensure Phase 2: correct installation and operability of the Possible additional testing phases Development/Testing technology, to integrate the technology with other systems). Formal validation of the testing  USTIF, local division of Italian transport Phase 3: phase and official authorization to Ministry (interests: to ensure correct Adoption/Diffusion technology utilization testing sessions and validate its results).  Turin Municipality: (interests: to take part to official events, such as opening of new stations/systems, and to participate in organizing communication procedures to people and local Bodies/Authorities).  Turin Metro Personnel (interests: to Opening of the new technology to Phase 3: organize the opening events of new public use Adoption/Diffusion stations/systems, to participate in organizing communication procedures to people and local Bodies/Authorities).  Turin Metro Users (interests: to express their opinion on new technology through surveys and/or interviews).  Turin Metro Personnel (interests: to monitor the status of Turin Metro systems, to collect information/experiences and to analyse/assess gaps or opportunities).  Industrial Providers (interests: to perform technology maintenance/updating, to propose new releases) Experiences collecting and  Turin Metro Users: (interests: to express Phase 4: analysis of new possible their opinion on possible future Sustainment/Wider change opportunities improvements of Turin Metro systems and services).  Police Department, Turin Municipality, Fire Department and other local authorities (interests: to ask Turin Metro for technologies updating, improvement/refining, or for new technology installations). Chart 9 Actors involved and interests

SCADA Systems (Supervisory Control and Data Acquisition) [acronym: SCADA] SCADA is expected to provide an automated, rapid and efficient management of security technical devices. For this reason it is strictly related to a number of different technologies, including VAL for the management of trains traffic, AVS for the mitigation of on-going fires, and most stations facilities (speakers, light signals, trains timetables, etc.). As far as concerned the interests of different actors, please refer to the tables in the previous paragraph.

Page 33 of 75

4.5 Obstacles during the innovation journey

Close Circuit Television [acronym: CCTV]

From the technical point of view no relevant obstacles have been found to CCTV deployment and diffusion. CCTV demonstrated to respect all the expectations, although during its Testing/Development phase some minor optimizations were done (such as the change of the batteries of Uninterruptible Power Supply system) to increase video-surveillance system performances. A specific issue regards the Adoption/Diffusion phase, where due to a pipe break some water filtered into a technical room, flooding and damaging some internal CCTV cameras. The problem was solved by isolating the cameras from the pipeline with an impermeable separator.

SCADA Systems (Supervisory Control and Data Acquisition) [acronym: SCADA] No relevant freedom infringement issues are related to this technology, since the data produced are mainly related to technical systems than to individuals. Further, people normally have a low “perception” of a SCADA system, especially if compared with other kind of technologies such as CCTV or RFID, this implies that no privacy problem is typically associated to this technology (“Interview 5, line 9”) SCADA demonstrated to have a good level of acceptance, although the high complexity of this technology may require some time before being properly managed by technical personnel. A critical point is represented by the strong interaction between SCADA and Information and Communication Technology world, which is typically characterized by fast dynamics. As a matter of fact, an electronic device can become obsolete in a very short time: this require SCADA systems to be modernized with a higher frequency with respect to other technologies.

4.6 The role of legislation

Close Circuit Television [acronym: CCTV]

From the social perspective, the infringement of individual rights has been one of the most relevant drivers at the beginning of CCTV systems design, and a large number of measures have been enforced in compliance with the Italian Regulations on Privacy (including Dlgs 196/2003). As an example, signs indicating that passengers are video-recorded are installed, CCTV data is cancelled after a period of time and no crossing data with RFID technology is done.

SCADA Systems (Supervisory Control and Data Acquisition) [acronym: SCADA]

Although the wide range of applications makes SCADA a dynamic technology in continuous evolution, there are standards to be taken in consideration when dealing with this technology. Some examples are:

Page 34 of 75

 NERC: Reliability Standards for the Bulk Electric Systems in North America  ISO 27000 Information technology - Security techniques  ISA 99 Manufacturing and Control Systems Security / IEC 62443  NISCC: Good Practice Guide - Process Control and SCADA Security, Overview  NIST 800-53: Recommended Security Controls for Federal Information Systems  IEC 62351: Power systems management and associated information exchange - Data and communications security  IEEE P 1686: Trial Use Standards for Retrofit Cyber Security of Serial SCADA Links and IED Remote Access

4.7 Technological Choice: Conclusion of the innovation journey results

Innovation journey analysis highlighted a series of criteria that strongly influenced decision makers dealing with CCTV and SCADA technologies. These criteria can be resumed as following:

Close Circuit Television [acronym: CCTV] Concept / New Option phase: Capability to mitigate a wide number of threats, regulation Dlgs 196/2003.

Testing / Development phase: Resolution, resistance to moisture.

Adoption / Diffusion phase: Acceptance level, security requirements from police authorities, privacy and freedom infringement of people

Sustainment / Wider Change: Innovative features development (like behavior recognition, motion detection, object recognition).

SCADA Systems (Supervisory Control and Data Acquisition) [acronym: SCADA] Concept / New Option phase: Capability to perform autonomous control, rapidity & efficiency, regulation: ISO 27000

Testing / Development phase: Precision, capability to simultaneously control many devices.

Adoption / Diffusion phase: Compatibility with other security systems

Sustainment / Wider Change: Easiness of use for new SCADA system, ICT evolution speed

Page 35 of 75

SMT Techn Actors Concept/ Testing/ Adoption Sustainment/ ology New Option Developme / Wider Change nt Diffusion Situation CCTV Security Committee for Capability to mitigate a wide Resolution Acceptance Innovative Features Awareness Turin Metro systems number of threats level development (like USTIF Resistance to behavior recognition, Fire Department of Turin Regulation Dlgs 196/2003 moisture Security motion detection, Industrial providers requirements object recognition). Turin Municipality from Police Police Department Authorities Turin Metro users Privacy and Turin Metro personnel freedom Other local authorities infringement of people Risk Assessment SCADA Security Committee for Capability to perform Precision Compatibility Easiness of use for Situation Turin Metro systems autonomous control with other new SCADA system Awareness USTIF Capability to security Enforcement Fire Department of Turin Rapidity & efficiency simultaneously systems ICT evolution speed Industrial providers control many Turin Municipality Regulation: ISO 27000 devices Police Department Turin Metro users Turin Metro personnel Other local authorities

Chart 10 Conclusion of the innovation journey results

Page 36 of 75

5. Innovation Journey: Identification Technologies

In the case study of Turin Metro the following Identification Technologies has been recognized:

 Smart RFID Card [acronym: RFID]

5.1 Technological functionality

In the following table SMTs types that technologies address are showed.

Identificati Physical Screening Risk Situation Enforcement on Access Assessment Awareness RFID x x x Chart 11 Identification Technologies, technological functionality

Radio-frequency identification (RFID) Radio-frequency identification (RFID) is a technology that uses radio waves to transfer data from an electronic tag, called RFID tag, attached to or embedded into an object, through a reader for the purpose of identifying and tracking the object. Some RFID tags can be read from several meters away and beyond the line of sight of the reader. The information is stored electronically in the tag that normally includes a small RF transmitter and receiver. An RFID reader transmits an encoded radio signal to interrogate the tag. The tag receives the message and responds with its identification information. Many RFID tags do not use a battery, but the radio energy transmitted by the reader as its energy source. RFID technology is a superior and more efficient way of identifying objects than manual system or use of bar code systems that have been in use since the 1970s [3]. Furthermore, passive RFID tags (those without a battery) can be read if passed within close enough proximity to an RFID reader, so it is not necessary to "show" the tag to the reader device, as with a bar code. In other words it does not require line of sight to "see" an RFID tag, so the tag can be read inside a case, carton, box or other container. Further, RFID tags can be read hundreds at a time, while bar codes can only be read one at a time. RFID technology was taken in consideration from the early phase of Turin Metro design, with the specific purpose to prevent unauthorized accesses. In the last years several RFID standard has been created, contemporary to the technology diffusion among Europe. RFID has been related to:

Page 37 of 75

- Identification category, since it supports the recognition of individuals; - Physical Access category, since it enables accesses restriction procedures; - Enforcement category, since it enforces people to pass the check-in and provide a valid ticket.

5.2 Security Sensitivity Areas involved

Internal area Tunnels Security Headquarter

The RFID system is located at entrance of the internal area and represents the first barrier to access train platforms. RFID identification is also required for the technical personnel to access tunnels area from train platforms. The central strategic Security Headquarters hosts the servers containing databases used to support RFID identification devices.

Public Area Internal Technical Trains Tunnels Security Area rooms Headquarter RFID x x x Chart 12 Security Sensitivity areas involved

5.3 Actors of the innovation journey

A number of Stakeholders took part in the decision processes regarding RFID technology:

Page 38 of 75

 Turin metro personnel (either technicians or managers), with the task to guarantee the functionality of Turin Metro Systems.  Other local Authorities (civil protection, red cross, category associations, etc.) with the tasks to guaranteeing people health, security, mobility and freedom.

Chart 13 Actors

5.4 Promises, expectations and interests of actors

The use of RFID brought relevant improvements into Turin Metro. The technology respected most of the expectations of Turin Metro designers, demonstrating to be an efficient measure to prevent unauthorized accesses and ticket falsification. No specific evolution in the future is forecasted for this technology, but the recent development of biometric recognition devices seems to open new possibilities: it is believed that associating the RFID with biometrics, relevant synergies could be achieved in coping against future security challenges.

The table below describes Turin Metro processes concerned to RFID technology and relates them to the respective phases of innovation journey method, highlighting the interests of the different actors involved (list not exhaustive).

Page 39 of 75

Technologies evolution process Phases of the Innovation Actors involved and interests (steps) Journey  Turin Metro Users: (interest: to express their opinion on possible improvements of Turin Metro systems and services). Identification of needs in terms of  Turin Metro Personnel (interests: to innovative technologies, and identify/validate Turin Metro needs in officially request for new Phase 1: Concept/New terms of innovative technologies). technology, highlighting system Options  Police Department, Turin Municipality, Fire improvements the new Department and other local authorities technology would bring (interests: to ask Turin Metro for technologies updating, improvement/refining, or for new technology installations).  Security Committee for Turin Metro systems (interests: to assess and validate Validation of the request and Phase 1: Concept/New identified technological needs with the aim process starting Options to guarantee adequate security improvement policies for Turin Metro transport system).  Turin Metro personnel (interests: to details Technical requirements definition Phase 1: Concept/New technological needs and to write a tender and tender writing Options for industrial providers).  Industrial Providers (interests: to participate and win the tender, to start a systematic provision of security technology Proposals presentation and Phase 1: Concept/New to Turin Metro). assessment Options  Turin Metro personnel (interests: to assess proposals and select the best technological opportunities).  Turin Metro personnel (interests: to enable the installation of the selected technology). Official authorization to the Phase 2:  USTIF, local division of Italian transport installation of the technology for a Development/Testing Ministry (interests: to validate the pre-operational testing phase installation of the selected technology for a pre-operational testing phase).  Turin Metro Personnel (interests: to ensure correct installation and operability of the technology, to integrate the technology with other existing security systems).  Industrial Providers (interests: to adjust/refine the technology to be compliant to Turin Metro systems security  Phase 2: requirements). Pre-operation testing phase Development/Tes  Fire Department of Turin (interests: to take ting part to testing procedures to verify fire control systems, alarms and communication procedures/devices, including emergency communication).  Police (interests: to take part to testing procedures to verify fire control systems, alarms and communication procedures/devices, including emergency

Page 40 of 75

communication).  USTIF, local division of Italian transport Ministry (interests: to ensure correct testing sessions and validate its results).  Turin Metro Personnel (interests: to assess technology performances).  Industrial Providers: (interests: to adjust/refine the technology to be compliant to Turin Metro systems security requirements).  Fire Department of Turin (interests: to take part to testing procedures to verify fire Technology performance control systems, alarms and communication assessment, possible technical Phase 2: procedures/devices, including emergency adjustments or related procedures Development/Testing communication). reviewing  Police (interests: to take part to testing procedures to verify fire control systems, alarms and communication procedures/devices, including emergency communication).  USTIF, local division of Italian transport Ministry (interests: to ensure correct testing sessions and validate its results).  Turin Metro Personnel (interests: to ensure Phase 2: correct installation and operability of the Possible additional testing phases Development/Testing technology, to integrate the technology with other systems). Formal validation of the testing  USTIF, local division of Italian transport Phase 3: phase and official authorization to Ministry (interests: to ensure correct Adoption/Diffusion technology utilization testing sessions and validate its results).  Turin Municipality: (interests: to take part to official events, such as opening of new stations/systems, and to participate in organizing communication procedures to people and local Bodies/Authorities).  Turin Metro Personnel (interests: to Opening of the new technology to Phase 3: organize the opening events of new public use Adoption/Diffusion stations/systems, to participate in organizing communication procedures to people and local Bodies/Authorities).  Turin Metro Users (interests: to express their opinion on new technology through surveys and/or interviews).  Turin Metro Personnel (interests: to monitor the status of Turin Metro systems, to collect information/experiences and to analyse/assess gaps or opportunities). Experiences collecting and Phase 4:  Industrial Providers (interests: to perform analysis of new possible Sustainment/Wider change technology maintenance/updating, to opportunities propose new releases)  Turin Metro Users: (interests: to express their opinion on possible future improvements of Turin Metro systems and services). Page 41 of 75

 Police Department, Turin Municipality, Fire Department and other local authorities (interests: to ask Turin Metro for technologies updating, improvement/refining, or for new technology installations). Chart 14 Actors involved and interests

5.5 Obstacles during the innovation journey

As a matter of fact, the infringement of individual rights has been one of the most relevant drivers from the beginning of RFID integration inside Turin Metro systems, since this technology can easily be used to “track” people threatening their individual privacy. This aspect is strictly related to all the four broad phases of the innovation journey, but played the most relevant role in the New Options and in the Adoption phases, where adequate organizational procedures were defined to avoid such risk. An example of such measures is that no sensible data (i.e. that may threat individuals’ privacy) is stored into the system, the only data permanently recorded concerns quantitative statistics (ex: number of daily passengers, etc.). In order to manage the access permission to different IDs, a “black list” (forbidden access) and a “grey list” (restricted access) have been set-up on RFID readers. A further measure consists in no crossing data with CCTV, to avoid physiognomy tracking of people. The possibility to integrate CCTV data with RFID data was discussed in the early phase of Turin Metro designing, but it was properly rejected for privacy issues. These measures seemed to be well-perceived by users: no complaint related to RFID systems has been registered yet, testifying a good level of acceptance of this technology.

A significant issue was experienced as a consequence of criminal events: the introduction of false tickets into RFID systems was able to cause damages to the RFID reading device. The problem was solved as well by updating the firmware of reading software, practically eliminating the possibility of unauthorized accesses. While from a social perspective no relevant obstacles to RFID integration into metro systems were found, a problem arose into the Adoption phase with concern to technical aspects. Some weekly- ticket IDs have not been correctly recognized in the early test of the technology, mainly in case of partially damaged or degraded ticket. The problem was solved by updating the firmware of RFID reading software.

5.6 The role of legislation

In recent years a number of organizations have set standards for RFID, including the International Organization for Standardization (ISO), the International Electro technical Commission (IEC), ASTM International, the DASH7 Alliance and EPC global. There are also several specific industries that

Page 42 of 75

have set guidelines including the Financial Services Technology Consortium (FSTC) have set a standard for tracking IT Assets with RFID, the Computer Technology Industry Association (CompTIA) has set a standard for certifying RFID engineers and the International Airlines Transport Association (IATA) set tagging guidelines for luggage in airports [4]. In Turin Metro context two regulations are strictly related to RFID use: the technical standard ISO/IEC 14443 and the Dlgs 196/03 (Italian on Privacy and Data Protection).

5.7 Technological Choice: Conclusion of the innovation journey results

Innovation journey analysis highlighted a series of criteria that strongly influenced decision makers dealing with RFID technology. These criteria can be resumed as following:

Concept / New Option phase: Capability to recognize false ticket, RFID standard Entities (ISO, IEC, ASTM, DASH7, EPC, FSTC, CompTIA), regulations (ISO/IEC 14443, Dlgs 196/03 on Privacy).

Testing / Development phase: Vulnerability to sabotage, reader precision, reader range.

Adoption / Diffusion phase: Acceptance level, privacy and freedom infringement of people, vulnerability to sabotage of RFID reader, available RFID software/or firmware

Sustainment / Wider Change: Competition of other technology with similar objective (biometrics, etc.).

SMT Techn Actors Concept/ Testing/ Adoption Sustainment/ ology New Option Developme / Wider Change nt Diffusion Identification RFID Security Committee for Capability to recognize false Vulnerability to Acceptance Competition of other Physical Access Turin Metro systems ticket sabotage level technology with USTIF similar objective Enforcement Fire Department of Turin RFID standard Entities: Reader precision Privacy and (biometrics, etc.) Industrial providers ISO freedom Turin Municipality IEC Reader Range infringement Police Department ASTM of people Turin Metro users DASH7 Turin Metro personnel EPC Vulnerability Other local authorities FSTC to sabotage CompTIA of RFID reader Regulations: ISO/IEC 14443 Available Dlgs 196/03 (Privacy) RFID softwares/or firmwares

Chart 15 Conclusion of the innovation journey results

Page 43 of 75

6. Innovation Journey: Information Processing & Communication Technologies

In the case study of Turin Metro the following Information Processing & Communication Technologies has been recognized:

 Internal Radio Network [acronym: RAD]

6.1 Technological functionality

In the following table SMTs types that technologies address are showed.

Identificati Physical Screening Risk Situation Enforcement on Access Assessment Awareness RAD x x Chart 16 Information Processing & Communication Technologies, technological functionality

Internal Radio Network [acronym: RAD] During crisis or emergency situations, radio is often used by transport facilities as a means of emergency communication when wire line, cell phones and other conventional means of communications may not be sufficient. The earliest radio stations were simply radiotelegraphy systems and did not carry audio. The first claimed audio transmission seem to be a broadcast occurred on Christmas Eve in 1906, and was made by Reginald Fessenden, also if whether this broadcast actually took place is disputed [6]. While many early experimenters attempted to create systems similar to radiotelephone devices where only two parties were meant to communicate, there were others who intended to transmit to larger audiences. Charles Herrold started broadcasting in California in 1909 [7] and was carrying audio by the next year. In Turin Metro a short-frequency radio network is used to support communication during alarm warnings or emergency/high risk situations. For this reason RAD has been related to Risk Assessment and Situation Awareness categories.

6.2 Security Sensitivity Areas involved

Public Area Internal area Technical rooms

Trains Tunnels Security Headquarter

Page 44 of 75

There are a number of local radio-devices inside all strategic areas allowing users to contact metro personnel or local security operators to communicate with other stations. Furthermore, a number of transmitter-receiver is diffused among stations, with a central coordinating point located in the Security Headquarter.

Public Area Internal Technical Trains Tunnels Security Area rooms Headquarter RAD X x x x x x Chart 17 Security Sensitivity areas involved

6.3 Actors of the innovation journey

A number of Stakeholders took part in the decision processes regarding RAD technologies:

Page 45 of 75

Chart 18 Actors 6.4 Promises, expectations and interests of actors

RAD has been installed with the purpose to increase Turin Metro capability to coordinate a large number of operators, in particular during emergency situations. It is well-known that “emergency” means short time to perform response measures, and a technology able to speed-up the management of resources and people can bring a significant improvement for the security of a mass transport facility. As a matter of fact, RAD is a transversal technology that can help decision- makers to cope with a wide number of security threats (including thefts, vandalisms, physical aggressions, terrorist actions, etc.) and safety threats (flood, fires, earthquakes, etc.) (“interview 5, line 7”).

The table below describes Turin Metro processes concerned to RAD technology and relates them to the respective phases of Innovation Journey method, highlighting the interests of the different actors involved (list not exhaustive).

Page 46 of 75

 Security Committee for Turin Metro systems (interests: to assess and validate Validation of the request and Phase 1: Concept/New identified technological needs with the aim process starting Options to guarantee adequate security improvement policies for Turin Metro transport system).  Turin Metro personnel (interests: to details Technical requirements definition Phase 1: Concept/New technological needs and to write a tender and tender writing Options for industrial providers).  Industrial Providers (interests: to participate and win the tender, to start a systematic provision of security technology Proposals presentation and Phase 1: Concept/New to Turin Metro). assessment Options  Turin Metro personnel (interests: to assess proposals and select the best technological opportunities).  Turin Metro personnel (interests: to enable the installation of the selected technology). Official authorization to the Phase 2:  USTIF, local division of Italian transport installation of the technology for a Development/Testing Ministry (interests: to validate the pre-operational testing phase installation of the selected technology for a pre-operational testing phase).  Turin Metro Personnel (interests: to ensure correct installation and operability of the technology, to integrate the technology with other existing security systems).  Industrial Providers (interests: to adjust/refine the technology to be compliant to Turin Metro systems security requirements).  Fire Department of Turin (interests: to take  Phase 2: part to testing procedures to verify fire Pre-operation testing phase Development/Tes control systems, alarms and communication ting procedures/devices, including emergency communication).  Police (interests: to take part to testing procedures to verify fire control systems, alarms and communication procedures/devices, including emergency communication).  USTIF, local division of Italian transport Ministry (interests: to ensure correct testing sessions and validate its results).  Turin Metro Personnel (interests: to assess technology performances).  Industrial Providers: (interests: to Technology performance adjust/refine the technology to be assessment, possible technical Phase 2: compliant to Turin Metro systems security adjustments or related procedures Development/Testing requirements). reviewing  Fire Department of Turin (interests: to take part to testing procedures to verify fire control systems, alarms and communication procedures/devices, including emergency communication). Page 47 of 75

 Police (interests: to take part to testing procedures to verify fire control systems, alarms and communication procedures/devices, including emergency communication).  USTIF, local division of Italian transport Ministry (interests: to ensure correct testing sessions and validate its results).  Turin Metro Personnel (interests: to ensure Phase 2: correct installation and operability of the Possible additional testing phases Development/Testing technology, to integrate the technology with other systems). Formal validation of the testing  USTIF, local division of Italian transport Phase 3: phase and official authorization to Ministry (interests: to ensure correct Adoption/Diffusion technology utilization testing sessions and validate its results).  Turin Municipality: (interests: to take part to official events, such as opening of new stations/systems, and to participate in organizing communication procedures to people and local Bodies/Authorities).  Turin Metro Personnel (interests: to Opening of the new technology to Phase 3: organize the opening events of new public use Adoption/Diffusion stations/systems, to participate in organizing communication procedures to people and local Bodies/Authorities).  Turin Metro Users (interests: to express their opinion on new technology through surveys and/or interviews).  Turin Metro Personnel (interests: to monitor the status of Turin Metro systems, to collect information/experiences and to analyse/assess gaps or opportunities).  Industrial Providers (interests: to perform technology maintenance/updating, to propose new releases) Experiences collecting and  Turin Metro Users: (interests: to express Phase 4: analysis of new possible their opinion on possible future Sustainment/Wider change opportunities improvements of Turin Metro systems and services).  Police Department, Turin Municipality, Fire Department and other local authorities (interests: to ask Turin Metro for technologies updating, improvement/refining, or for new technology installations). Chart 19 Actors involved and interests

6.5 Obstacles during the innovation journey

No acceptance problem or freedom infringement issues seemed to concern RAD technology in any of its evolution phases, testifying a good acceptance level among all categories of Turin Metro Page 48 of 75

users. This validated the security concept embedded in Turin Metro perspective which relies on, between others, the pillar of communicability. A minor technical issue concerned RAD during its Testing/Development phase, where the industrial company in charge of the maintenance services was asked to re-configure radio frequency, to optimize the communication reliability. After the Adoption/Diffusion phase of this technology, it demonstrated to respect all the expectations Turin Metro had, being an efficient measure to coordinate many people located in different stations. Concerning the Sustainment/Wider Change phase of RAD, the creation of a restricted channel for first response teams to increase the efficiency of emergency operations seems to be the most likely option.

6.6 The role of legislation

Three international standards have been identified concerning radio transmission: a) ITU (International Telecommunication Unit)

Band ID Frequency ELF 3 – 30 Hz SLF 30 – 300 Hz ULF 300 – 3000 Hz VLF 3 – 30 kHz LF 30 – 300 kHz MF 300 – 3000 kHz HF 3 – 30 MHz VHF 30 – 300 MHz UHF 300 – 3000 MHz SHF 3 – 30 GHz EHF 30 – 300 GHz Chart 20 ITU frequency b) IEEEE (Institute of Electrical and Electronics Engineers)

Band ID Frequency HF 3 - 30 MHz VHF 30 - 300 MHz UHF 300 - 1000 MHz L 1 – 2 GHz S 2 – 4 GHz

Page 49 of 75

C 4 – 8 GHz X 8 – 12 GHz Ku 12 – 18 GHz K 18 – 26 GHz Ka 26 – 40 GHz V 40 – 75 GHz W 75 – 111 GHz Chart 21 IEEEE frequency

c) NATO (North Atlantic Treaty Organization)

Band ID Frequency A 0 - 250 MHz B 250 - 500 MHz C 500 - 1000 MHz D 1 – 2 GHz E 2 – 3 GHz F 3 – 4 GHz G 4 – 6 GHz H 6 – 8 GHz I 8 – 10 GHz J 10 – 20 GHz K 20 – 40 GHz L 40 – 60 GHz 60 – 100 GHz M

Chart 22 NATO (OTAN) frequency The role of the legislator is to assign frequencies for the different users in order to avoid overlapping of the data, but to allow the coordination with other entities (e.g. civil protection). No more specific role of legislation has been able to be spot by performed interviews.

6.7 Technological Choice: Conclusion of the innovation journey results

Innovation journey analysis highlighted a series of criteria that strongly influenced decision makers dealing with RAD technology. These criteria can be resumed as following:

Page 50 of 75

Concept / New Option phase: Capability to coordinate many people located in different stations, Capability to provide support during emergency situation, with particular reference to security threats (thefts, vandalisms, physical aggressions, terrorist actions, etc.) and safety threats (flood, fires, earthquakes, etc.).

Testing / Development phase: Availability / range of radio communication, rapidity and efficiency of emergency/ first response operations

Adoption / Diffusion phase: Radio transmission standards (NATO, IEEEE, ITU)

Sustainment / Wider Change: Cost, rapidity and efficiency of maintenance services, configurability of radio broadcasting systems.

SMT Technology Actors Concept/ Testing/ Adoption Sustainment/ New Option Developme / Wider Change nt Diffusion Risk RAD Security Committee for Capability to coordinate many Availability / Radio Cost , rapidity and Assessment Turin Metro systems people located in different Range of radio transmission efficiency of Situation USTIF stations communication standards: maintenance services Awareness Fire Department of Turin NATO Industrial providers Capability to provide support Rapidity and IEEEE Configurability of Turin Municipality during emergency situation, efficiency of ITU radio broadcasting Police Department with particular reference to emergency/ first systems. Turin Metro users security threats (thefts, response Turin Metro personnel vandalisms, physical operations Other local authorities aggressions, terrorist actions, etc.) and safety threats (flood, fires, earthquakes, etc.). Chart 23 Conclusion of the innovation journey result

Page 51 of 75

7. Innovation Journey: Intrusion Protection & Defence Technologies

In the case study of Turin Metro the following Intrusion Protection & Defence Technologies has been recognized:

 Automatic Light Vehicle system [acronym: VAL]  Platform screen doors [acronym: PSD]

7.1 Technological functionality

In the following table SMTs types that technologies address are showed.

Identificati Physical Screening Risk Situation Enforcement on Access Assessment Awareness VAL x x x PSD x x Chart 24 Intrusion Protection & Defence Technologies, technological functionality

Véhicule Automatique Léger VAL is a type of automatic technology, based on an invention by Professor Robert Gabillard (Université Lille Nord de France). It was designed in the early 1980s by French Matra, for the metro system in Lille. The acronym was originally for Villeneuve d'Ascq à Lille (Villeneuve d'Ascq to Lille), the route of the first line to be inaugurated, but now it officially stands for Véhicule Automatique Léger (automatic light vehicle). In contrast to some other driverless metro systems like the Docklands Light Railway or Vancouver's SkyTrain, the VAL design uses platforms that are separated from the rollways by a glass partition, to prevent waiting passengers from straying or falling onto the rollways. Turin Metro is based on VAL technology, being is a fully automated train system (that is without driver) remotely controlled by a Control Center, where operators can act to change the system status or enforce operational measures. The term VAL embraces in itself a wide number of technical devices and systems, all finalized to perform an efficient stand-alone management (that is, without the need of the personnel, such as the driver or platform local operators) of Turin Metro trains. These devices can include physical barriers, enforcement measures, and local control/monitoring systems, and due to this issues VAL technology has been related to Physical Access, Enforcement and Situation Awareness categories. Related As previously mentioned, in case of anomalous situations or system malfunctions security personnel can manually intervene to set-up VAL, enforce operations or change system features, but Page 52 of 75

the ordinary use of VAL does not require human interactions. Reliability, Availability and Service Quality were the key words In the Concept/New Options phase of this technology.

Platform screen doors (PSD) at train or subway stations screen the platform from the train. They are a relatively new addition to many metro systems around the world, with some platform doors retrofitted rather than installed with the metro system itself. They are widely used in Asian and European metro systems. Examples of world metro systems that employ platform screen doors are the following: Plaza de Cuba station in the Seville Metro, Spain; Xicun Station, Guangzhou Metro, People's Republic of China; Nangang Exhibition Center Station, Taipei - Nangang Line; Minquan W. Road Station, Taipei - Luzhou Line; Euljiro 3-ga Station in Seoul; Silom station Bangkok Metro Thailand; Tokyo Metro Namboku Line. Turin Metro hosts PSD in all its stations. PSD technology has been related to Physical Access category, since it enables to prevent unauthorized accesses from platforms to railways tracks zone and tunnels.

7.2 Security Sensitivity areas involved

Véhicule Automatique Léger [acronym: VAL]

Trains Tunnels Security Headquarter

VAL systems mainly embrace trains (automated movement systems) and tunnel (automated trains tracking). The Security Headquarters host a control center monitoring VAL systems operability and data produced.

Platform screen doors [acronym: PSD]

Internal area Trains

Platform screen doors (PSD) is located on the boundary between internal area and trains, directly after the “yellow line” (passengers safe area) painted on the ground.

Page 53 of 75

Public Area Internal Technical Trains Tunnels Security Area rooms Headquarter VAL x x x PSD x x Chart 25 Location of intrusion protection & defence technologies 7.3 Actors of the innovation journey

A number of Stakeholders took part in the decision processes regarding VAL and PSD technologies:

Page 54 of 75

Chart 26 Actors

7.4 Promises, expectations and interests of actors

Véhicule Automatique Léger [acronym: VAL]

VAL was expected to fulfill a major objective: a reliable and fully automated subway system, requiring few human resources for its management and maintenance. It was designed to guarantee an “always working” system, able to perform adequate responses in case of dangerous situation or technical failures, and to allow a quick intervention of operators when necessary (“interview 2, line 3”)

It is worth to say that the choice of a security technology in Turin Metro is always associated with a deep risk analysis, aimed at identifying and preventing every kind of risk or anomalous situation. This strongly regarded VAL, due to its high level of innovation.

There is a wide range of drivers lead toward the use of this technology:

- an increase of security and safety of metro areas: VAL allows the use of automated platform door to prevent accidental falls off the platform onto the lower track area, suicide attempts and homicides by pushing; - a reliability increase of metro services, being less subjected to strikes or similar events; - an high quality of trains environment, due to the low noise and the integrated climate control system; - the feedback coming from other European mass transports using VAL technology.

Page 55 of 75

The market pressure did not significantly influence VAL Concept/New Options phase, and the industrial companies entered in the process only after the requirements for new technological options had already been defined.

As far as concerned the interests of different actors, please refer to the tables in the previous paragraph.

Platform screen doors [acronym: PSD] PSD technologies have been chosen from the early design stage of Turin Metro, believing it would have had a great impact both on security and safety. The main expectations from this technology where the possibility to:  prevent accidental falls off the platform onto the lower track area, suicide attempts and homicides by pushing;  improve security by restricting access to the tracks and tunnels;  prevent or reduce wind felt by the passengers caused by the “Piston effect” (air compression and decompression caused by trains movement) which could in some circumstances make people fall over;  reduce the risk of accidents, especially from service trains passing through the station at high speeds;  improve climate control within the station (heating, ventilation, and air conditioning are more effective when the station is physically isolated from the tunnel);  integrate in metro system some of the most recent technologies in the field of security, such as automated trains (see VAL technology);  prevent litter build up on the track which can be a fire risk.

It is worth to say that among the security threats considered within the Concept/New Options phase of PSD, terrorism played a significant role. The events occurred in the past (such as terrorist attacks to Spanish Railways) are a clue that terrorism is a crucial issue for mass transports, and that employment smart systems to protect people, especially during major and overcrowded events, represents a major challenge.

The table below describes Turin Metro processes concerned to VAL and PSD technologies and relates them to the respective phases of Innovation Journey method, highlighting the interests of the different actors involved (list not exhaustive).

Technologies evolution process Phases of the Innovation Actors involved and interests (steps) Journey

Identification of needs in terms of Phase 1: Concept/New  Turin Metro Users: (interest: to express innovative technologies, and Options their opinion on possible improvements of officially request for new Turin Metro systems and services).

Page 56 of 75

technology, highlighting system  Turin Metro Personnel (interests: to improvements the new identify/validate Turin Metro needs in technology would bring terms of innovative technologies).  Police Department, Turin Municipality, Fire Department and other local authorities (interests: to ask Turin Metro for technologies updating, improvement/refining, or for new technology installations).  Security Committee for Turin Metro systems (interests: to assess and validate Validation of the request and Phase 1: Concept/New identified technological needs with the aim process starting Options to guarantee adequate security improvement policies for Turin Metro transport system).  Turin Metro personnel (interests: to details Technical requirements definition Phase 1: Concept/New technological needs and to write a tender and tender writing Options for industrial providers).  Industrial Providers (interests: to participate and win the tender, to start a systematic provision of security technology Proposals presentation and Phase 1: Concept/New to Turin Metro). assessment Options  Turin Metro personnel (interests: to assess proposals and select the best technological opportunities).  Turin Metro personnel (interests: to enable the installation of the selected technology). Official authorization to the Phase 2:  USTIF, local division of Italian transport installation of the technology for a Development/Testing Ministry (interests: to validate the pre-operational testing phase installation of the selected technology for a pre-operational testing phase).  Turin Metro Personnel (interests: to ensure correct installation and operability of the technology, to integrate the technology with other existing security systems).  Industrial Providers (interests: to adjust/refine the technology to be compliant to Turin Metro systems security requirements).  Fire Department of Turin (interests: to take  Phase 2: part to testing procedures to verify fire Pre-operation testing phase Development/Tes control systems, alarms and communication ting procedures/devices, including emergency communication).  Police (interests: to take part to testing procedures to verify fire control systems, alarms and communication procedures/devices, including emergency communication).  USTIF, local division of Italian transport Ministry (interests: to ensure correct testing sessions and validate its results).

Page 57 of 75

 Turin Metro Personnel (interests: to assess technology performances).  Industrial Providers: (interests: to adjust/refine the technology to be compliant to Turin Metro systems security requirements).  Fire Department of Turin (interests: to take part to testing procedures to verify fire Technology performance control systems, alarms and communication assessment, possible technical Phase 2: procedures/devices, including emergency adjustments or related procedures Development/Testing communication). reviewing  Police (interests: to take part to testing procedures to verify fire control systems, alarms and communication procedures/devices, including emergency communication).  USTIF, local division of Italian transport Ministry (interests: to ensure correct testing sessions and validate its results).  Turin Metro Personnel (interests: to ensure Phase 2: correct installation and operability of the Possible additional testing phases Development/Testing technology, to integrate the technology with other systems). Formal validation of the testing  USTIF, local division of Italian transport Phase 3: phase and official authorization to Ministry (interests: to ensure correct Adoption/Diffusion technology utilization testing sessions and validate its results).  Turin Municipality: (interests: to take part to official events, such as opening of new stations/systems, and to participate in organizing communication procedures to people and local Bodies/Authorities).  Turin Metro Personnel (interests: to Opening of the new technology to Phase 3: organize the opening events of new public use Adoption/Diffusion stations/systems, to participate in organizing communication procedures to people and local Bodies/Authorities).  Turin Metro Users (interests: to express their opinion on new technology through surveys and/or interviews).  Turin Metro Personnel (interests: to monitor the status of Turin Metro systems, to collect information/experiences and to analyse/assess gaps or opportunities).  Industrial Providers (interests: to perform technology maintenance/updating, to Experiences collecting and Phase 4: propose new releases) analysis of new possible Sustainment/Wider change  Turin Metro Users: (interests: to express opportunities their opinion on possible future improvements of Turin Metro systems and services).  Police Department, Turin Municipality, Fire Department and other local authorities (interests: to ask Turin Metro for technologies updating,

Page 58 of 75

improvement/refining, or for new technology installations). Chart 27 Actors involved and interests

7.5 Obstacles during the innovation journey

Véhicule Automatique Léger [acronym: VAL]

As expected from a relatively innovative technology, a number of technical adjustments have been done in the Testing/Development phase of VAL. As an example, trains batteries typology was changed during test session to optimize the performances of power supply system. Further, the chassis length has been doubled to best fulfill user requirements, and several firmware updates have been performed to eliminate the possibility of false warning from trains systems. A survey done in June 2011 demonstrated that VAL had a very high level of acceptance among all categories of Turin Metro users. This validated the security concept embedded in Turin Metro perspective that relies on the pillars, among others of communicability and perception of surrounding environment (temperature, relative humidity, low level of noise, etc.). A worth measure taken during Adoption/Diffusion phase to increase the acceptance level was the use of two-language signs and vocal messages in trains and stations. The total absence of complaints from users is as well an indicator that an initial promise of VAL has been fulfilled. This fact was also demonstrated by the crescent trend of passenger numbers (users became from 30000/day to 150000/day in about 5 years, also due to the implementation of lines’ extensions). Even if the current level of risk associated to VAL seems to be quite low, operators are aware that this may change in the future. It is difficult to forecast VAL against still unknown threats, but it is well-known that in case of major public events (like Olympic Games) a revision of security measures and procedures may be required, in order to raise further the “attention level” of the system (“interview 1, line 16”).

Platform screen doors [acronym: PSD] PSD represent in itself a completely automated technology: in case of anomalous situations or system malfunctions security personnel can manually intervene to enforce operations the ordinary functionality of PSD does not require any human interaction. No specific technical issues seemed to have slowed the diffusion of this technology in any of its phases, although a minor technical issue was observed in the Testing/Development phase with regard to the transmission system: after the first test session the belt connected with platform doors was changed, to increase the sensitivity of doors control system.

No particular acceptance problems or freedom infringement issues seemed to concern PDS technology in any of its evolution phases, testifying a good acceptance level among all categories of Turin Metro users. This validated the security concept embedded in Turin Metro perspective that supposes an individual can feel secure if having a wide and clear visual perception of surrounding environment.

Page 59 of 75

No specific evolution is forecasted in the future of PSD. It is believed that the high acceptance, the strong usability the commonly associated feeling of „modernity“, will ease PDS technology diffusion to other Italian and European mass transport facilities.

7.6 The role of legislation

Véhicule Automatique Léger [acronym: VAL]

The relatively recent development of VAL and its high heterogeneity and configurability make quite difficult to find concerned Regulation and Standards. In the Italian context it is worth to mention the DLGS 753/80 regarding trains management and the DLGS 196/03 regarding privacy issues (VAL may embed micro video and/or audio surveillance), even if in Turin Metro only data concerning ordinary management of metro systems are normally recorded.

Platform screen doors [acronym: PSD] No specific standard for Platform Screen doors have been identified.

7.7 Technological Choice: Conclusion of the innovation journey results

Innovation journey analysis highlighted a series of criteria that strongly influenced decision makers dealing with VAL and PSD technology. These criteria can be resumed as following:

Véhicule Automatique Léger [acronym: VAL] Concept / New Option phase: Capability to bring a relevant increase of security and safety of metro areas, an increase in the reliability of metro services, being less subjected to strikes or similar events, an high quality of trains environment, due to the low noise and the integrated climate control system; feedback coming from other European mass transports using VAL technology, and acceptance level

Testing / Development phase: Level of autonomy, maintenance services, performances of power supply system, false warning rate from trains systems, efficiency of transmission systems

Adoption / Diffusion phase: Acceptance level, regulations: DLGS 753/80, (train management), DLGS 196/03, (privacy), number of tickets sold

Sustainment / Wider Change: Cost, rapidity and efficiency of maintenance services, train management cost reduction coming from VAL systems.

Platform screen doors [acronym: PSD] Concept / New Option phase: Capability to:

Page 60 of 75

 prevent accidental falls off the platform onto the lower track area, suicide attempts and homicides by pushing;  improve security by restricting access to the tracks and tunnels;  prevent or reduce wind felt by the passengers caused by the “Piston effect” (air compression and decompression caused by trains movement) which could in some circumstances make people fall over;  reduce the risk of accidents, especially from service trains passing through the station at high speeds;  improve climate control within the station (heating, ventilation, and air conditioning are more effective when the station is physically isolated from the tunnel) ;  integrate in metro system some of the most recent technologies in the field of security, such as automated trains (see VAL technology);  prevent litter build up on the track which can be a fire risk.

Testing / Development phase: Usability

Adoption / Diffusion phase: Acceptance level

Sustainment / Wider Change: Cost of PSD technology

SMT Technology Actors Concept/ Testing/ Adoption Sustainment/ New Option Developme / Wider Change nt Diffusion Physical VAL Security Committee for Capability to bring: Level of Acceptance Cost , rapidity and Access Turin Metro systems - a relevant increase of autonomy level efficiency of Situation USTIF security and safety of maintenance services Awareness Fire Department of Turin metro areas Maintenance Regulations: Industrial providers - an increase in the services DLGS 753/80 Train management Enforcement Turin Municipality reliability of metro (train Cost reduction coming Police Department services, being less Performances of management) from VAL systems. Turin Metro users subjected to strikes or power supply DLGS 196/03 Turin Metro personnel similar events system (privacy) Other local authorities - an high quality of trains environment, due to the False warning Number of low noise and the rate from trains tickets sold integrated climate control systems system Efficiency of Feedback coming from other transmission European mass transports systems using VAL technology.

Acceptance Physical PSD Security Committee for Capability to: Usability Acceptance Cost of PSD Access Turin Metro systems  - prevent accidental falls off level technology Enforcement USTIF the platform onto the lower Fire Department of Turin track area, suicide attempts Industrial providers and homicides by pushing; Page 61 of 75

Turin Municipality  improve security by restricting Police Department access to the tracks and Turin Metro users tunnels; Turin Metro personnel  - prevent or reduce wind felt Other local authorities by the passengers caused by the “Piston effect” (air compression and decompression caused by trains movement) which could in some circumstances make people fall over;  - reduce the risk of accidents, especially from service trains passing through the station at high speeds;  - improve climate control within the station (heating, ventilation, and air conditioning are more effective when the station is physically isolated from the tunnel) ;  - integrate in metro system some of the most recent technologies in the field of security, such as automated trains (see VAL technology);  - prevent litter build up on the track which can be a fire risk.

Chart 28 Conclusion of the innovation journey results

Page 62 of 75

8. Bibliography

[1] Andrew H. Van de Ven (1999): The Innovation Journey . Oxford University Press, New York.

[2] Arie Rip; Johan W. Schot (2002): Identifying loci for influencing dynamics of technological development. In: Shaping Technology. Guiding Policy; concepts Spaces and Tools. Edward Elgar, Cheltenham, pp. 158-176.

[3] Landt, Jerry (2001). "Shrouds of Time: The history of RFID". AIM, Inc

[4] Catherine O'Connor, Mary (2004). "Gen 2 EPC Protocol Approved as ISO 18000-6C". RFID Journal.

[5] Siemens (2006), Trade press release, Berlin,

[6] Fessenden (2006), The Next Chapter.

[7] Baudino, Joseph E; John M. Kittross (Winter, 1977). "Broadcasting's Oldest Stations: An Examination of Four Claimants", Journal of Broadcasting.

[8] Cooke, B.W.C., ed. "Sliding Doors on Platform Edge". The Railway Magazine (Westminster: Tothill Press).

[9] Dornberger, Walter: V-2, Ballantine Books 1954, ASIN

[10] Hamamatsu Photonics K.K. Laser group (2006). "The Fibre Disk Laser explained".

[11] Prosser, Richard, Birmingham Inventors And Inventions. H.M. Patent Office (originally 1881) later published by S.R. Publishers 1970.

[12] IEEE 802.3-2008 standard, Gigabit Ethernet

[13] Dosi, G. (1988). Sources, Procedures, and Microeconomic Effects of Innovation. Journal of Economic Literature , 1120-1171.

[14] Garud, R., & Ahlstrom, D. (1997). Technology assessment: a socio-cognitive perspective. Journal of engineering and Technology Management , 25-48.

[15] Mayring, P. (2007). Qualitative Inhaltsanalyse. Grundlagen und Techniken. Weinheim und Basel.

[16] Moors, E. H., Rip, A., & Wiskerke, J. S. (2004). The Dynamics of Innovation: A Multilevel Co- Evolutionary Perspective. In J. S. Wiskerke, & J. v. Ploeg, Seeds of Transition: Essays on Novelty Production, Niches and Regimes in Agriculture (pp. 31-56). Assen: Royal van Gorcum.

Page 63 of 75

[17] Rip, A., & Schot, J. W. (2002). Identifiying Loci for Influencing the Dynamics of Technological Development. In K. H. Sörensen, & R. Williams, Shaping Technology. Guiding Policy: Concepts, Spaces, Tools (pp. 158-176). Cheltenham: Edward Elgar Publishing.

[18] Schumpeter, J. (1942). Capitalism, Socialism, and Democracy. New York.

[19] The European Commission. (2010). EU 185/2010. Retrieved 3 22, 2012, from http://eur- lex.europa.eu/LexUriServ/LexUriServ.do?uri=OJ:L:2010:055:0001:0055:EN:PDF

[20] The European Parliament. (2002). EU 2320/2002. Retrieved 3 23, 12, from http://eur- lex.europa.eu/LexUriServ/LexUriServ.do?uri=CELEX:32002R2320:EN:HTML:NOT

[21] Van de Ven et al., A. H. (2000). Innovation Journey. Oxford University Press.

[22] Van Langenhove, L., & Bertolink, R. (1999). Positioning and Assessment of Technology. In R. Harré, & L. Van Langenhove, Positioning Theory: Moral Contexts of Intentional Action (pp. 117-126). Malden.

[23] Van Lente, H., & Rip, A. (1998). Expectations in Technological Developments: An Example of Prospective Structures to be Filled in by Agency. In C. Disco, & C. van der Meulen, Getting new technologies together (pp. 195-220). Berlin.

Page 64 of 75

9. Appendix: Interview Guideline

1. General Aspects - Security Concept

In the beginning of the interview, I would like to ask you some general questions about the current security concept and the use of technologies according to the concept.

 Please describe briefly your function and the tasks of your department / organizational unit.

 What is the current standard for security technologies and measures at the airport/ transport system? How did they become standard technologies?

 Please describe your security concept and the SMTs that have chosen to implement the concept?

 What kind of threats and risks do you deal with in your security concept?

 Do you have any general assessment criteria for the introduction of new technologies?

 How do these technologies work, what kind of data do they gather and how is the data being processed and used? Which information systems are behind the used technologies? How autonomously do those technologies act?

 Is there any participation on research programs regarding new technology options?

 Do you conduct pilot projects or tests for security technologies or measures? Do you have general assessment criteria for the tests?

 Is there an orientation towards other pilot projects or tests? Do you share information about test results with other airports/ transport systems?

2. Detection Technologies

First I would like to ask you, if you know anything about the time where the detection technologies only existed as a concept or idea?

If this is not the case, we continue with the development phase

If yes …

 Which were the actors and conditions that supported and obstructed as the detection technology only existed as a concept or idea?

Page 65 of 75

 How was the detection technology promoted by the market at this time? What was the articulated functionality?

 What kind of security gain was promised at the time the detection technology has been mere an idea?

 What was the reason for the development of the new technology? Was there any pressure for a solution?

Could you now explain how the detection technology was tested and developed prior to their implementation?

If this is not the case, we continue with the adoption phase

If yes …

 Please describe the cooperation between the different actors during the development of the new detection technology. Did any conflicts occur at this time? What were they about?

 Who was supposed to buy the technology and who was supposed to use it?

 Did any cultural issues occur during the testing phase that had an impact on the estimated acceptance of the technology?

 What have been the assessment criteria? How did you put them together?

 Were there any problems during the development and testing phase? Were there any actions taken to solve the problem (technical, legal, organizational, ethical…)?

 Have the promises/ objectives been achieved/ fulfilled during the testing phase?

After having talked about the development and testing of the detection technologies, we would like to know more about how they have been adapted and diffused. Do you have any knowledge about that?

If this is not the case, we go on with some questions about surveillance technologies.

If yes …

 When has the detection technology become operational? Was it introduced to meet a certain situation?

 Do any alternatives exist that can provide the same level of security? If so, why did you choose to reject them?

Page 66 of 75

 Can you name the “driving force” in your company that promoted the implementation of the detection technology?

 Which standards or assessment criteria have been crucial for the implementation of the detection technology?

 Has the detection technology been extended or modified since its first application? If this is the case how and why? Have its promises been fulfilled?

 Do the partners / actors involved in implementing the detection technology share a common assessment of the technology or do they differ in their perspectives?

 What kind of acceptance problems came up during the implementation?

 Have cultural differences been considered when the detection technology was implemented?

 How could the detection technology infringe personal freedom? What kinds of CITs exist to balance infringements?

 What kinds of threat scenarios are associated with the implemented detection technology? Is the technology capable to adjust to new threat scenarios?

3. Surveillance Technologies

Now I would like to ask you, if you know anything about the time where the surveillance technology only existed as a concept or idea?

If this is not the case, we go on with the development phase

If yes…

 Which were the actors and conditions that supported and obstructed as the surveillance technology only existed as a concept or idea?

 How was the surveillance technology promoted by the market at this time? What was the articulated functionality?

 What kind of security gain was promised at the time the surveillance technology has been mere an idea?

 What was the reason for the development of the new technology? Was there any pressure for a solution?

Page 67 of 75

Could you now, explain how the surveillance technology was tested and developed prior to their implementation?

If this is not the case, we continue with the adoption phase

If yes …

 Please describe the cooperation between the different actors during the development of the new surveillance technology. Did any conflicts occur at this time? What were they about?

 Who was supposed to buy the technology and who was supposed to use it?

 Did any cultural issues occur during the testing phase that had an impact on the estimated acceptance of the technology?

 What have been the assessment criteria? How did you put them together?

 Were there any problems during the development and testing phase? Were there any actions taken to solve the problem (technical, legal, organizational, ethical…)?

 Have the promises/ objectives been achieved/ fulfilled during the testing phase?

After having talked about the decision about the development and testing of the surveillance technology, we would like to know more how they are adapted and diffused. Do you have any knowledge about that?

If this is not the case, we go on with some questions about the identification technology.

If yes …

 When has the surveillance technology become operational? Was it introduced to meet a certain situation?

 Do any alternatives exist that can provide the same level of security? If so, why did you choose to reject them?

 Can you name the “driving force” in your company that promoted the implementation of the surveillance technology?

 Which standards or assessment criteria have been crucial for the implementation of the surveillance technology?

 Has the surveillance technology been extended or modified since its first application? If this is the case how and why? Have its promises been fulfilled?

Page 68 of 75

 Do the partners / actors involved in implementing the surveillance technology share a common assessment of the technology or do they differ in their perspectives?

 What kind of acceptance problems came up during the implementation?

 Have cultural differences been considered when the surveillance technology was implemented?

 How could the surveillance technology infringe personal freedom? What kinds of CITs exist to balance infringements?

 What kinds of threat scenarios are associated with the implemented surveillance technology? Is the technology capable to adjust to new threat scenarios?

4. Identification Technologies

Now I would like to ask you, if you know anything about the time where the identification technology only existed as a concept or idea?

If this is not the case, we go on with the development phase

If yes …

 Which were the actors and conditions that supported and obstructed as the identification technology only existed as a concept or idea?

 How was the identification technology promoted by the market at this time? What was the articulated functionality?

 What kind of security gain was promised at the time the identification technology has been mere an idea?

 What was the reason for the development of the new technology? Was there any pressure for a solution?

Could you now, explain how the identification technology was tested and developed prior to their implementation?

If this is not the case, we continue with the adoption phase

If yes …

Page 69 of 75

 Please describe the cooperation between the different actors during the development of the new identification technology. Did any conflicts occur at this time? What were they about?

 Who was supposed to buy the technology and who was supposed to use it?

 Did any cultural issues occur during the testing phase that had an impact on the estimated acceptance of the technology?

 What have been the assessment criteria? How did you put them together?

 Were there any problems during the development and testing phase? Were there any actions taken to solve the problem (technical, legal, organizational, ethical…)?

 Have the promises/ objectives been achieved/ fulfilled during the testing phase?

After having talked about the decision about the development and testing of the identification technology, we would like to know more how they are adapted and diffused. Do you have any knowledge about that?

If this is not the case, we go on with some questions about the information processing and communication technology.

If yes …

 When has the identification technology become operational? Was it introduced to meet a certain situation?

 Do any alternatives exist that can provide the same level of security? If so, why did you choose to reject them?

 Can you name the “driving force” in your company that promoted the implementation of the identification technology?

 Which standards or assessment criteria have been crucial for the implementation of the identification technology?

 Has the identification technology been extended or modified since its first application? If this is the case how and why? Have its promises been fulfilled?

 Do the partners / actors involved in implementing the identification technology share a common assessment of the technology or do they differ in their perspectives?

 What kind of acceptance problems came up during the implementation?

 Have cultural differences been considered when the identification technology was implemented?

Page 70 of 75

 How could the identification technology infringe personal freedom? What kinds of CITs exist to balance infringements?

 What kinds of threat scenarios are associated with the implemented identification technology? Is the technology capable to adjust to new threat scenarios?

5. Information Processing & Communication Technologies

Now I would like to ask you, if you know anything about the time where the information processing and communication technology only existed as a concept or idea?

If this is not the case, we go on with the development phase

If yes …

 Which were the actors and conditions that supported and obstructed as the information processing and communication technology only existed as a concept or idea?

 How was the information processing and communication technology promoted by the market at this time? What was the articulated functionality?

 What kind of security gain was promised at the time the information processing and communication technology has been mere an idea?

 What was the reason for the development of the new technology? Was there any pressure for a solution?

Could you now, explain how the information processing and communication technology was tested and developed prior to their implementation?

If this is not the case, we continue with the adoption phase

If yes …

 Please describe the cooperation between the different actors during the development of the new information processing and communication technology. Did any conflicts occur at this time? What were they about?

 Who was supposed to buy the technology and who was supposed to use it?

 Did any cultural issues occur during the testing phase that had an impact on the estimated acceptance of the technology?

Page 71 of 75

 What have been the assessment criteria? How did you put them together?

 Were there any problems during the development and testing phase? Were there any actions taken to solve the problem (technical, legal, organizational, ethical…)?

 Have the promises/ objectives been achieved/ fulfilled during the testing phase?

After having talked about the decision about the development and testing of the information processing and communication technology, we would like to know more how they are adapted and diffused. Do you have any knowledge about that?

If this is not the case, we go on with some questions about the intrusion protection and defence technology.

If yes …

 When has the information processing and communication technology become operational? Was it introduced to meet a certain situation?

 Do any alternatives exist that can provide the same level of security? If so, why did you choose to reject them?

 Can you name the “driving force” in your company that promoted the implementation of the information processing and communication technology?

 Which standards or assessment criteria have been crucial for the implementation of the information processing and communication technology?

 Has the information processing and communication technology been extended or modified since its first application? If this is the case how and why? Have its promises been fulfilled?

 Do the partners / actors involved in implementing the information processing and communication technology share a common assessment of the technology or do they differ in their perspectives?

 What kind of acceptance problems came up during the implementation?

 Have cultural differences been considered when the information processing and communication technology was implemented?

 How could the information processing and communication technology infringe personal freedom? What kinds of CITs exist to balance infringements?

 What kinds of threat scenarios are associated with the implemented information processing and communication technology? Is the technology capable to adjust to new threat scenarios? Page 72 of 75

6. Intrusion Protection and Defence Technologies

Now I would like to ask you, if you know anything about the time where the intrusion protection and defence technology only existed as a concept or idea?

If this is not the case, we go on with the development phase

If yes …

 Which were the actors and conditions that supported and obstructed as the intrusion protection and defence technology only existed as a concept or idea?

 How was the intrusion protection and defence technology promoted by the market at this time? What was the articulated functionality?

 What kind of security gain was promised at the time the intrusion protection and defence technology has been mere an idea?

 What was the reason for the development of the new technology? Was there any pressure for a solution?

Could you now, explain how the information intrusion protection and defence technology was tested and developed prior to their implementation?

If this is not the case, we continue with the adoption phase

If yes …

 Please describe the cooperation between the different actors during the development of the new intrusion protection and defence technology. Did any conflicts occur at this time? What were they about?

 Who was supposed to buy the technology and who was supposed to use it?

 Did any cultural issues occur during the testing phase that had an impact on the estimated acceptance of the technology?

 What have been the assessment criteria? How did you put them together?

 Were there any problems during the development and testing phase? Were there any actions taken to solve the problem (technical, legal, organizational, ethical…)?

 Have the promises/ objectives been achieved/ fulfilled during the testing phase?

Page 73 of 75

If this is not the case, we go on with the last section

If yes …

 When has the intrusion protection and defence technology become operational? Was it introduced to meet a certain situation?

 Do any alternatives exist that can provide the same level of security? If so, why did you choose to reject them?

 Can you name the “driving force” in your company that promoted the implementation of the intrusion protection and defence technology?

 Which standards or assessment criteria have been crucial for the implementation of the intrusion protection and defence technology?

 Has the intrusion protection and defence technology been extended or modified since its first application? If this is the case how and why? Have its promises been fulfilled?

 Do the partners / actors involved in implementing the intrusion protection and defence technology share a common assessment of the technology or do they differ in their perspectives?

 What kind of acceptance problems came up during the implementation?

 Have cultural differences been considered when the intrusion protection and defence technology was implemented?

 How could the intrusion protection and defence technology infringe personal freedom? What kinds of CITs exist to balance infringements?

 What kinds of threat scenarios are associated with the implemented intrusion protection and defence technology? Is the technology capable to adjust to new threat scenarios?

7. Outlook and Future Perspectives

Finally, we would like to ask some questions about future perspectives of the security technologies we have been talking about.

Page 74 of 75

 Are there tendencies towards future technology investments (from the perspective of the infrastructure provider)? What are the reasons or motivation to invest?

 What kind of future threat and security risks are assumed for the future?

 Are the current technologies sufficient to meet the future threats? Please explain the answer. Are there any other solutions?

 What are the possible changes in your security concept? What are your wishes for future changes?

 Which requirements would you have for a security technology assessment support system? Which questions should be answered?

 Are there any important topics that we haven´t mentioned so far?

Page 75 of 75