Skip to content
← Grupo Aprecisa · Connecting those who know with those who need
Gaspar do Amaral

State, public works and governance · Article published on LinkedIn on 3 April 2026

The Governance of Critical Infrastructure and Two-Speed Responsibility

Centralising is not protecting: governing critical infrastructure with responsibility at two speeds

Gaspar do Amaral · 3 April 2026

Translated from the Portuguese original. This version was issued on 30 October 2026.

PDF (7 pages)Discussion on LinkedIn (in Portuguese)

Original illustration of the article, with its texts in Portuguese and English: “Arquitetura da sobrevivência — sistemas ciberfísicos & governação crítica” (architecture of survival — cyber-physical systems and critical governance), “por Eng. Gaspar do Amaral”. At the centre, a “core backbone” of luminous hubs (a port, an airport, a power line, a city) linked by beams of light, with the labels “ZKP”, “risk audit: AA rating”, “STAMP metrics” and “financial lattice”; below, “edge networks” of charging points and buildings, separated from the core by switches marked “isolamento galvânico” (galvanic isolation), with two nodes marked “islanded”. © Aprecisa.com
Original illustration of the article, with its texts in Portuguese and English: “Arquitetura da sobrevivência — sistemas ciberfísicos & governação crítica” (architecture of survival — cyber-physical systems and critical governance), “por Eng. Gaspar do Amaral”. At the centre, a “core backbone” of luminous hubs (a port, an airport, a power line, a city) linked by beams of light, with the labels “ZKP”, “risk audit: AA rating”, “STAMP metrics” and “financial lattice”; below, “edge networks” of charging points and buildings, separated from the core by switches marked “isolamento galvânico” (galvanic isolation), with two nodes marked “islanded”. © Aprecisa.com

By Eng. Gaspar do Amaral

The planning of infrastructure on a national scale suffers from a chronic illusion: the belief that centralised control equals security. Over decades of integrating land, sea and air transport systems, I have learned that when the State tries to be the “goalkeeper” of a cyber-physical network, it is not building a shield; it is raising a target.

To dismantle this fallacy and design a collapse-proof model, intuition is not enough; the science of complex systems must be called upon. As Donella Meadows details in her magnum opus Thinking in Systems: A Primer, intervening in a system should focus on redesigning its information flows and its penalty rules (the feedback loops), not on micro-controlling its nodes. The State must therefore abandon centralisation and embrace the principle of Two-Speed Responsibility (Responsabilidade a Duas Velocidades).

Pillar I: The Dual Speed and the Transfer of Risk (the End of the State Gateway)

The current architecture treats all infrastructure alike, creating what the sociologist Charles Perrow defines in Normal Accidents as “tight coupling”. If we connect the chargers of retail SMEs to a central State security gateway, an anomaly at the periphery or a direct attack on the centre paralyses the whole country. Engineering requires us to cut this coupling.

For the Core Network (backbone) — airports, ports and intermodal hubs — failure is inadmissible. Yet the audit should not be bureaucratic, but financial. The pioneer Ross Anderson, in Security Engineering, establishes that information security invariably fails when the entity that manages the risk is not the one that pays the bill for the disaster. The solution is to require the audit of the Core Network to be carried out by global reinsurers. We thus apply the central thesis of Nassim Nicholas Taleb in his book Skin in the Game: without the risk of financial and criminal ruin, private operators do not build resilient systems. If the insurance market does not validate the consortium, the State does not issue the licence.

In the Edge Network (urban capillarity), applying this military burden would destroy local SMEs, a scenario against which Prof. Rosário Macário (IST) frequently warns in her studies on transaction costs in transport regulation. For the edge, the requirement moves to the purely electromechanical plane: the mandatory installation of a galvanic isolation circuit breaker. If the software is breached, the station is physically cut off from the national grid, sacrificing the vehicle but saving the nation.

Pillar II: Zero-Knowledge Proofs (Auditing without a Honeypot)

The traditional licensing model requires companies to hand their algorithms over to the State for testing. The expert Bruce Schneier, in his book Click Here to Kill Everybody, warns that these State sandboxes are quickly turned into gigantic honeypots (cyber lures), attracting attacks from hostile States and putting at risk the intellectual property (IP) of global consortia.

Cyber pedagogy offers a solution carved in pure mathematics. Instead of asking for the data, the State demands an equation that attests to the truth. As theorised by Shafi Goldwasser and Silvio Micali in their founding paper “The Knowledge Complexity of Interactive Proof-Systems”, we use zero-knowledge proofs (ZKP). The State dictates the disaster scenario; the operator runs the simulation in its laboratory and returns to the regulator a cryptographic key that irrefutably validates that the system withstood it, without revealing a single line of code. From the standpoint of the information theory taught by Prof. Mário Figueiredo (IST), the State obtains absolute certainty through mathematical entropy, keeping its own system immune to hosting other parties’ data.

Pillar III: Graceful Degradation and Asynchronous Survival (the End of the Induced Blackout)

The most serious weakness of current tender specifications is the requirement for continuous telemetry. If the State requires the station to send a constant heartbeat to authorise operation, an attacker only has to cut a submarine fibre cable — a strategic vulnerability I followed closely when designing systems in South-East Asia — to create an electrical and logistical blackout.

Infrastructure has to learn to operate in the dark. Amory Lovins, in the memorable report Brittle Power commissioned by the Pentagon, proves analytically that grids must have edge autonomy. This is where theory meets the electrical engineering of Prof. João Peças Lopes (INESC TEC), a pioneer of the concept of islanding (island operation). Without communications, the station stops bidirectional integration (V2G) so as not to destabilise the national system, but keeps supplying vital energy from local batteries.

In this scenario of chaos comes the masterly theory of the Portuguese researcher Paulo Veríssimo, set out in his papers on cyber-physical intrusion tolerance. The system abandons the illusion that the firewall is impenetrable; it assumes the enemy is already inside the communications and adopts graceful degradation managed by independent hardware. In addition, security processes stop focusing on component failure and are orchestrated as an integrated control problem, applying the STAMP methodology developed by Prof. Nancy Leveson in her book Engineering a Safer World.

Conclusion

We cannot fight the fluid threats of the twenty-first century with the static regulatory thinking of the twentieth. As Prof. Carlos Fiolhais often argues in his defence of the scientific method applied to the public sphere, political decision cannot override the laws of thermodynamics or the limits of cryptography.

And by aligning our technological infrastructure with the vision of Organisational Architecture championed by Prof. José Tribolet (IST), we realise that the State does not build: the State legislates the mathematics of risk. Two-Speed Responsibility forces the market to be antifragile.

Technical Annex: Summary of Parameters for Public Tender Specifications

To carry this model over into public procurement, the preambles and technical clauses of the tender specifications of the Central Administration (DGEG, AMT, IMT, IP) should mandatorily adopt the following grid:

1. Qualification Criteria for the Core Network (Concessions of Systemic Risk)

2. Technical Standards for the Edge Network (Capillarity in Public/Private Domain)

3. Inspection and Certification Methodology

Bibliographical References and Structural Contribution to the Proposal

The literature that scientifically validates the structural premises of this Two-Speed Responsibility, by Gaspar do Amaral is detailed below:

International authors

National authors and researchers (Portugal)

Methodological note

What this page is. An English translation of the article the author published on LinkedIn on 3 April 2026; the full Portuguese version is on this site. The article contains no calculations of its own; the technical parameters of the annex (>50 kW, < 20 ms, > 30 s, 48 h, “AA” rating) are those of the original.

Changes of form, not substance. In the original, some names carry several links to the same address; here each carries one. The tracking parameters LinkedIn added to some links have been removed. DGEG, AMT, IMT and IP are Portuguese public bodies (energy, transport regulation, mobility and infrastructure); IPQ is the Portuguese Quality Institute and CNCS the National Cybersecurity Centre.

The discussion is on LinkedIn (in Portuguese)

Comments on this text are made on LinkedIn, where the article was shared in Portuguese. You are welcome to write in English. Agree, disagree or add data: every well-founded objection receives a reply.

Comment on LinkedIn (in Portuguese) Download the PDF (7 pages)

Gaspar do Amaral · Original in Portuguese of 3 April 2026, published on this site; translation issued on 30 October 2026 · Figures and tables © Aprecisa.com · AI-assisted

How to cite: Gaspar do Amaral (2026). A Governação de Infraestruturas Críticas e a Responsabilidade a Duas Velocidades. Zenodo. https://doi.org/10.5281/zenodo.23814359 · Permanent archive on Zenodo.