Comparing the resilience objectives of Finnish comprehensive security model and the NATO baseline requirements for resilience

After the Cold War, the NATO community redefined its mission. The war against terror and similar contexts of asymmetric warfare started to guide the defence and strategy planning. NATO members scaled down their defence budgets and preparedness against traditional war (NATO 2021b). A major part of the infrastructure critical to the armed forces was privatised (Meyer-Minnemann 2016). This period of the so called ‘peace dividend’ came to an end when Russia invaded Crimea in 2014 (Berglof 2015: 294), and it was clear that NATO was not ready for such hybrid warfare, let alone a traditional war. It can be argued that adapting the concept of resilience to the NATO community aims to oppose such hybrid threats and indicates a return to a whole-of-society approach (Meyer-Minnemann 2016). NATO defines resilience as ‘the individual and collective capacity to prepare for, resist, respond to and quickly recover from shocks and disruptions’ (NATO 2023b). The aim of resilience is not to prevent a risk from happening but rather to ensure ‘the continuity of the Alliance’s activities’ (NATO 2023b). By increasing resilience, NATO aims to respond to a complexity of threats, not just military ones. COVID-19, cyberthreats, hybrid-warfare, and climate change are named as possible threats to the alliance (NATO 2021b). It must be noted that although NATO has defined resilience (NATO 2023b), the concept’s relation to other concepts such as preparedness is not explicitly or clearly stated. Some NATO sources seem to state that (civil) preparedness enhances resilience (NATO 2021b). However, other sources suggest that the NATO baseline requirements (NBRs) of resilience reflect ‘the three core functions of civil preparedness’ (NATO 2023b), which further suggests that the resilience enhances preparedness. Thus, in the NATO context, the concepts of resilience and preparedness are used on many occasions somewhat interchangeably, and there does not seem to be a clear hierarchical relation between the concepts.

Four stakeholder groups are identified in civil preparedness: NATO itself, the member countries, private sector, and the population. The member country is responsible for establishing ‘the legislative and institutional framework’ for the crisis response and has to ‘develop emergency plans and early warning tools’ (NATO 2021b, p. 4). Ensuring adequate funding and keeping up emergency stocks are named as national responsibilities (ibid.), as well as making decisions and communicating them effectively to the population. The private sector is deemed responsible for the functioning supply chains of ‘essential goods’ and ‘operation of key infrastructure’ (ibid, p. 5). It is also evident that NATO would use private resources for communications and transport in a crisis (Lasconjarias 2017). The civilian population must be able to cope with the crisis. This includes training, individual ‘food stocks’, and ‘respect of the measures set out by authorities’ (NATO 2021b, p. 6).

NATO has established seven baseline requirements (NBR) for resilience, which ‘provide a comprehensive framework to support the effective enablement of our armed forces and of NATO’s three core tasks’ (NATO 2021a). The NBRs were first agreed upon by the NATO defence ministers and later by the heads of the states and governments of NATO (Meyer-Minnemann 2016). The baseline requirements are as follows: 1)

assured continuity of government and critical government services

More detailed descriptions of the NBRs are presented in Appendix 1. The NBRs can be seen as minimum criteria for the NATO member states, and they are constantly revised. However, the seven general categories have remained similar. Guidelines and evaluation criteria for the requirements are published by the committees under the Resilience Committee (NATO 2022). The detailed guidelines of the operationalisation and evaluation criteria of the NBR’s have been declared NATO unclassified. The documents being NATO unclassified includes that they are released to the NATO community and partner countries (Jonsson and Veibäck 2020) but are not publicly available.

The modern history of Finnish preparedness can be understood to comprise of three phases: total defence, comprehensive defence, and comprehensive security (Valtonen and Branders 2021). The phases reflect the Finnish threat perceptions of their time. The first phase, the phase of total defence, starts from the 1950s and includes the notion that as Finland was located next to the Soviet Union and had, after gaining its independence in 1917, already fought two major wars with it, all the resources of the society were needed to be prepared to defend itself (Heikka 2005). This included the national economy, communication systems, medical support, and civil preparedness that were all included in the defence planning (Heikka 2005; Valtonen and Branders 2021). The second phase, comprehensive defence, started in the 1990s as the end of the Cold War meant that the threat perceptions were updated and Finland among other nations moved to a broader notion of threat perceptions. However, while many European countries significantly reduced their capabilities to fight traditional wars by, for example, abolishing large, reserve-based armed forces, Finland preserved much of the old approach. However, the Finnish threat perceptions were updated to include broad security challenges, for example, international terrorism and crime (Riipinen 2008). Over time, the emergence of hybrid threats and the constantly broadening threat perceptions started the third phase called comprehensive security. It included new sectors of administration and actors of the society (Government of Finland 2017) to the security strategy, and the cooperation of the authorities became a major aspect of the strategy.

The CSM is a Finnish model of preparedness that is based on an all-of-society approach and broad notion of security (Government of Finland 2017). It aims to secure the ‘vital functions of society’ (Government of Finland 2017, p. 5). The main document describing the CSM is The Security Strategy for Society from 2017 (ibid.). The strategy presents seven vital functions of the society, which are to be secured through the cooperation of ‘security actors’ (Government of Finland 2017, p. 7). The vital functions for society that must be maintained in every situation are presented in Table 1.

Cooperation of security actors is a major aspect of the CSM (Valtonen and Branders 2021). The Security Strategy for Society identifies ‘authorities, business operators, organisations and citizens’ as security actors (Government of Finland 2017, p. 7). Authorities are responsible for the ‘drafting of preparedness legislation, steering and development as well as in the implementation of the preparedness measures’ (ibid, p. 7). The strategy names central government, authorities, municipalities, universities, and research institutions as sub-categories of the category of authorities. Businesses ‘play a key role in […] the functioning of the economy and the infrastructure’ (ibid, p. 7–8), and their role in providing vital services, for example health care services, is acknowledged. In CSM, the organisations are considered as a group consisting of NGOs and, for example, religious communities. Their role is to ‘provide services, coordinate the participation of volunteers in the activities supporting authorities’ (ibid, p. 8), and the group is also labelled as organisations and other bodies (ibid, p. 11). Individual citizens are considered important security actors and their ‘knowledge and skills […] as their security-oriented attitude form the basis for a resilient society’ (ibid, p. 8).

The understanding of resilience as a concept is much narrower in the Finnish than in the Anglo-Saxon context (Hyvönen and Juntunen 2021) and thus most of NATO. A glance at the Finnish security-related government documents reveals that resilience as a concept is used to describe individual capabilities to cope with distress. The concept of resilience can even be called to be domesticated into an ‘auxiliary role’ in the CSM (Hyvönen and Juntunen 2021, p. 171). The concepts used more often in the Finnish strategies than resilience involve preparedness and security of supply. According to the Security Strategy for Society:

“[p]reparedness means activities ensuring that all tasks can continue with minimum interruptions and that the required exceptional measures can be performed during disruptions occurring in normal conditions and during emergencies”

The understanding of preparedness is arguably somewhat similar to NATO’s description because the aim of preparedness is not to prevent disruption but to adapt to it. The Finnish concept of security of supply covers a much broader field than the name would suggest. The concept means:

“preparedness for crises and disruptions as well as continuity management so that the production, services and infrastructure necessary for the subsistence of the population, the economy and national defence can be secured during serious disruptions and in emergency conditions”

As noted by Aaltola et al. (2016, p. 79), the concept is problematic as internationally it is used mainly to refer to material supplies and usually in the context of military and energy sector.

Due to the challenges related especially to the concept of security of supply, there has been some discussion whether the concept of resilience should be used more broadly in Finnish security discourse, but this has not been unreserved. For example, Aaltola et al. (2016) argued that resilience has to be well defined before implementing it. Also, it is argued that resilience can mean moving from preventive ‘producing of security’ to ‘reactive recovery’ or even ‘survival’ (ibid, p. 80).

A government report on the security of supply (Ministry of Economic Affairs and Employment 2022, p. 13) suggests on a general level that the CSM responds well to the requirements set by the seven NBRs and that the CSM covers more areas than the NBRs. Next, the methods for testing this claim are presented.

The documents reviewed in the first part are Finnish official documents regarding comprehensive security. The analysis focuses on the most recent government level documents that were published between 2013 and 2022. The government level is understood as resolutions and reports accepted by ministers or ministries but not for example study group reports published by the government. Thus, the document material is deemed to reflect the official interpretation of the phenomena studied.

The documents included in the first part are the following:

Ministry for Foreign Affairs (2022) Government report on changes in the security environment.

Documents regarding European Union resilience and Finnish international relations were omitted because they are also approved and implemented by nations other than Finland, and the present paper focuses on comparing the NATO and the Finnish models. However, it must be noted that the EU and NATO have recently started cooperating on building resilience (European Commission 2023) and EU resilience legislation, and also, most importantly, the Critical Entities Resilience directive set requirements for Finnish preparedness. English versions of the documents were used where available, and the references refer to the English versions. Finnish versions of the documents were used if needed to improve the understanding of the use of definitions for example. The selection of all relevant documents was ensured by two means: by examining for cross references and by the expert interviews. The documents were examined for references of other government level documents, and relevant reference documents were included in the analysis. Also, the interviewees were asked to name additional documents if necessary.

The selected sources were systematically reviewed and analysed. The analysis did not aim to explicitly find the same phrases as used in the NBRs but to categorise whether similar objectives are tried to be achieved within the Finnish strategies. If the analysed document suggested which of the actors are responsible for a certain NBR category, this information was recorded.

The instances of NBRs in the Finnish materials were compiled into spreadsheets. The instances were charted by assigning a note to each of them. This was done according to the level of the sign of the NBR: was it merely mentioned (in a list with other concepts for example), was it mentioned individually (in its own sentence for example), or was it mentioned in more detail (several sentences or a paragraph)? Also, a note was made on the explicit or implicit nature of the sign of NBR. If the sign was interpreted to be unambiguously reflecting an NBR, it was considered explicit. However, if the sign was related to or partly overlapping with an NBR, but not at the core of it, the sign was considered implicit. After all the 12 documents were indexed, the information was charted to identify which NBR levels were not covered by the government level documents.

The second empirical part concentrated on the NBR areas for which no information was found in the first part of the document analysis. It consisted of analysis of lower-level official documents. This included guidelines published by ministries or major national Finnish NGOs for example. The documents used had to, however, reflect the public authorities and the Finnish comprehensive security as a model. Therefore, for example, documents published by local NGOs were not used. The search for sources was iterative in nature. This means that when a NBR was covered in previously analysed documents, no additional sources were sought for more information on this particular NBR, and the emphasis was moved to the NBRs not yet covered.

The interviews had two objectives: gathering data for the areas not yet covered in the document analysis and triangulation to validate the results. The main aim of the expert interviews was to find out if a source had been unnoticed regarding the NBR areas still not covered after the two document analysis parts and if there was a justified reason for this.

The experts interviewed were identified by locating the authority responsible for the NBR area and contacting the department responsible for preparedness in that area. The responsible departments were allowed to name their best experts to be interviewed. Four interviews (Respondents 2–5) were conducted regarding the two missing NBR areas, two for each. One additional interview was conducted to gain a view from outside the ‘focus NBR’ areas (Respondent 1). The interviews were semi-structured. The NBRs defined the frames for the overall interest area of the interviews, but otherwise, the questions were open-ended in nature. While saturation was not the goal for the round of expert interviews, the data obtained from the interviews showed considerable overlap regarding key issues. As such, this round of expert interviews was satisfactory to address the limited gaps remaining after the two document analysis rounds.

The continuity of government is referred to as decision-making capacity and communications in the Finnish CSM. Both aspects are well expressed in the national and private/NGO level in the government level documents.

Decision-making capacity is mentioned explicitly in detail in the Security Strategy for Society (Government of Finland 2017) under the vital function of Leadership. The general guidelines of cooperation of the ‘Government, Parliament and the President of the Republic’ (ibid, p. 30) in an emergency are presented, and the Government Situation Centre is tasked with gathering and analysing ‘information on the security situation as well as on incidents and threats that endanger vital functions of society’ to support decision making (ibid, p. 31).

Communication is clearly emphasised in all the sources that considered leadership. Communications were presented as two separate strategic tasks in the Security Strategy for Society, which states that: ‘[r]eliable, effective and correctly timed internal and external communications are an essential part of the management of incidents and emergencies’ (Government of Finland 2017, p. 32) and that communications ‘strengthen citizens’ resilience during incidents and emergencies’ (ibid, p. 89).

The businesses and NGOs are seen as an important part of communications. It was deemed important that the media operators can ‘produce and share reliable and up-to-date information’ (Ministry for Foreign Affairs 2022), and the need to improve strategic security communications amongst authorities, private sector, and NGOs was presented (Ministry of the Interior 2017, p. 39). However, the organisations are not deemed just one-way medium of communication but an important medium of detecting the morale of the population by communicating ‘citizens’ feelings to the authorities’ (Government of Finland 2017, p. 89). The individuals are instructed to have a back-up communication system, for example, a battery radio, and that fighting against information operations requires source criticism and only trusting reliable sources (The Finnish National Rescue Association 2023a).

The NBR of resilient energy supplies is well covered in the government level documents regarding authorities and businesses. For the individual level, lower-level documents cover the NBR. It is stated (Government of Finland 2017, p. 21) that ‘[d]omestic solutions and international cooperation will ensure continuous supply of energy’ and it is highlighted that the private sector is in a leading role in the energy preparedness and ‘the preparedness measures taken by the public sector are of supplementary nature’ (ibid, p. 64).

The Government Resolution on the Objectives of the Security of Supply states that the ‘oil refining capabilities’ must be maintained at a sufficient level to ‘support the energy security of supply’ (Ministry of Economic Affairs and Employment 2018, p. section 6) and that the state must have a ‘share majority and power to decide’ in the national grid and natural gas transmission network companies. Also, a national stock of 5 months average consumption of fuels, coal, oil products and natural gas must be maintained by the authorities (Ministry of Economic Affairs and Employment 2022, p. 34–38).

The most detailed objectives of preparedness are given to the energy companies. The Government Resolution on the Objectives of the Security of Supply states that the energy producers must aim to create a communication network that would function for 24 h in a power outage amongst themselves. District heating companies must consider ‘major disruptions and national emergencies’ in their preparedness planning by reserving ‘emergency stocks and preparing for power outages’ (Ministry of Economic Affairs and Employment 2018, section 6). The importer companies and energy suppliers, for example, must maintain an emergency stock of 2–3 months of the fuels used (Ministry of Economic Affairs and Employment 2022, p. 33). The network companies are also tasked to assure the energy supply by ‘underground cabling’ of the networks and ‘building more circular connections’ (Government of Finland 2017, p. 64). It can be argued that this is exactly what the NATO requirements demand in the form of: ‘back-up plans and power grids’ (NATO 2021b, p. 8).

On the individual level, the NBR is covered by instructions on how to cope with a power outage. The 72 h concept provides with a list of supplies that should be kept at home in case of a power outage (The Finnish National Rescue Association 2023a).

Resilient civil communications services is the most comprehensively covered NBR in the CSM’s national level. The Security Strategy for Society (Government of Finland 2017, p. 59–60) aims to guarantee the information services needed by the authorities to maintain situational awareness and decision-making capability. Also, ensuring ‘availability of critical electronic communications services’ (ibid, p. 61) for the whole society is presented as an objective. The private service providers are tasked to ensure that the operations continue with ‘minimum interruptions’ during the crisis (ibid, p. 61). Among other cooperating authorities, Ministry of Defence and the Finnish Defence Forces are mentioned, and thus, it can be argued that the civilian networks can also be used by the military (Government of Finland 2017, p. 61) as required by NATO (NATO 2016, para. 4).

The private businesses are presented in the role of service providers regarding the civil communications, and the cooperation is based on agreements between the authorities and the companies (Government of Finland 2017). Their role is especially in keeping the systems secure so that ‘their control systems for energy supply, logistics chains or other critical infrastructure cannot be breached directly through an open network’ (Ministry for Foreign Affairs 2022, p. 33). The role of the financial service providers is emphasised, and it is stated that disruptions in such services ‘might endanger the continuation of the functions vital to society’ (Government of Finland 2017, p. 58).

Individual citizens are explicitly mentioned in detail in the Government report on the security of supply (Ministry of Economic Affairs and Employment 2022), which argues for attaching cyber security teaching to all education levels and states that the consumers’ electronic devices should be well guarded against malware as the devices can otherwise be used in attacks against critical objects. In lower-level documents, the civil communication systems are considered, and it is deemed important to stay safe online by using ‘firewalls, antivirus software and website certificates’ and having a compensatory means of communications available in case of an emergency – mainly a battery radio (The Finnish National Rescue Association 2023a).

The NBR of resilient food and water supplies is covered explicitly on all three levels by the government level documents. The security strategy for society includes three strategic tasks that cover the NBR: ‘Safeguarding the water supply’ (Government of Finland 2017, p. 75), which includes ‘steering and monitoring’ activities for the authorities; ‘Safeguarding food supply’ (ibid, p. 79), which involves for example monitoring; and safety stocks, ensuring the supply of daily consumer goods (ibid, p. 80).

The importance of safety stocks is also mentioned in the Government resolution on the objectives of the security of supply (Ministry of Economic Affairs and Employment 2018, section 7.4) that states that a safety stock of grain sufficient for at least 6 month average consumption is held in state’s stocks. Measures to safeguard water supplies include ‘securing the supply of electricity, chemicals and components’ and also ‘enhancing cyber security and preparedness against disruptions’ (Ministry of Economic Affairs and Employment 2022, p. 37).

The level of private businesses and NGOs is covered by two government level documents. The security strategy for society notes the importance of functioning food supply chains: ‘[t]he functioning of the order-delivery chain in digital and physical environments (including foreign trade) is ensured in cooperation with business operators’ (Government of Finland 2017, p. 79). The water plant operators are deemed responsible for disruption preparedness including ‘physical and cyber security’, and they are responsible for making necessary ‘infrastructure investments’ to safeguard the reliability of the systems (Ministry of Economic Affairs and Employment 2018, section 7). The NATO NBR of resilient food and water supply aims to safeguard the supplies from ‘disruption or sabotage’ (NATO 2021b, p. 8). Therefore, including the physical and cyber security aspect to the food and water supplies helps covering the NATO requirements.

Resilient water and food supplies are the only NBR well covered with regard to individuals in the government level documents. This is due to the fact that the 72 h concept’s household preparedness instructions are presented (Ministry of the Interior 2017; Ministry of Economic Affairs and Employment 2022, p. 24).

The NBR of resilient civilian transportation systems is considered in several strategic tasks in the Security strategy for society. The strategy aims to ensure the functionality of the ‘critical transport and communications networks’, which include for example: ‘key transport hubs, such as ports, terminals and airports as well as critical transport routes’ (Government of Finland 2017, p. 67). Also, the ‘National Emergency Supply Agency maintains stockpiles of imported fuels so that Finland has, on average, reserves of imported fuels for 5 months’ normal consumption’ (ibid, p. 63).

The level of private companies and NGOs is represented mainly regarding emergency stocks and partnership agreements. Likewise, regarding food supplies and energy supplies, the transportation is safeguarded by ‘obligatory stockpiling of imported fuels by the companies’ (Government of Finland 2017, p. 63). This is a rare occasion of regulation-based compulsory preparedness of the companies because most of the preparedness measures by companies and NGOs are based on voluntary participation. Together the National Emergency Supply Agency and the importing companies maintain a stockpile of imported fuels that satisfies the demand for 5 months of normal consumption (ibid.).

Private companies and to some extent the NGOs are deemed important partners especially from the military’s point of view. The Finnish Defence Force’s logistics is supported by ‘cooperation partners, both in the private and public sector’, and the cooperation has been deepened by ‘logistics exercises together, developed partnership management mechanisms and partner companies’ preparedness planning, and the creation of a situational picture’ (Government of Finland 2021a, p. 24).

Mentions of the individual level cannot be found in government level or lower-level documents. Only a minor implicit remark was found regarding reserving fuel for transportation in the lower-level documents: ‘If you drive a car, keep the tank at least half full or a reserve fuel container available’ (The Finnish National Rescue Association 2023b). This is not deemed a problem because extending obligatory measures to citizens was deemed both unnecessary and not possible according to current legislation (Respondent 3). Thus, individual’s preparedness is based on voluntarism: ‘[The authorities] aim to give advice [to the citizens] but it [the preparedness] is never the individual citizen’s responsibility. This means that you [the citizen] has the freedom to act on her own.’ (Respondent 3).

Also, according to the respondents, the Finnish authorities have been utilising the information obtained in the Partnership for Peace cooperation with NATO from the beginning of the cooperation in 1990s (Respondent 3). Since the CSM was considered to cover the NBRs in all parts (Respondents 2 and 3), the substance in the NBRs was not considered a problem.

Finnish authorities consider that the preparedness for large-scale population movements consists of two main aspects: large-scale movement of migrants over the border and large-scale evacuation of Finnish residents (Respondent 4). The Security strategy for society covers the evacuation of Finnish residents by the strategic task of ensuring proper housing, which consist of ‘[l]egislative and administrative preparedness to resettle large numbers of people in an emergency’ (Government of Finland 2017, p. 74).

The NGOs have an important role in the preparedness for large-scale population movements. The Finnish Red Cross is mentioned in multiple occasions and has an agreement with the authorities ‘on support services concerning the reception of asylum seekers and on the maintenance of a continuous reception preparedness’ (Government of Finland 2017, p. 49). Its and other NGOs’ and private companies’ role in the large-scale immigration of 2015 was deemed important in several interviews: ‘Companies and NGOs, such as the Finnish Red Cross, operate a major part of our immigrant reception centers.’ (Respondent 4).

The individual citizens were not included in the government level documents, and only minor implicit remarks were found in the lower-level documents regarding voluntarily accommodating immigrants at home (for example: Ministry of the Interior n.d.). The experts did not see this as a problem, and it was deemed that the NGOs were the right means to organise the individuals’ work (Respondent 4).

The ability to deal with mass casualties is well covered by several strategic tasks under three vital functions. This includes maintaining emergency response centres and rescue services in order to ‘contribute to the preparedness of society for incidents and catastrophes in all circumstances’ (Government of Finland 2017, p. 47). The material preparedness is guaranteed by ‘[o]bligatory and emergency stockpiles of pharmaceuticals as well as emergency stockpiles of medical equipment and supplies’ (ibid, p. 69). It is also noted that ‘regarding the use of the (medical) materials and their procurement, also the requirements of cooperation with the Finnish Defence Forces have to be considered’ (Ministry of Economic Affairs and Employment 2022, p. 42).

The level of NGOs and private companies is utilised in two aspects: stock-piling and voluntary preparedness. Pharmaceutical companies are a rare sector in Finland that is under legal obligation of preparedness to for example ‘stockpile pharmaceutical substances and products’ (Government of Finland 2017, p. 78).

The volunteers are stated to be in an ‘important role’ in ‘rescue operations, in tasks supporting the authorities and in supporting independent preparedness’ (Government of Finland 2017, p. 19). The volunteer fire brigades offer an illustrative example as they participate in approximately 60% of the rescue tasks (Ministry of the Interior 2021, p. 23).

The individuals’ level is covered in the lower-level documents in three main ways: readiness to shelter indoors, personal medical stockpile, and training first aid skills. The readiness to shelter indoors is mentioned in the 72 h concept and is an important part of preparedness against chemical, biological, radiological, and nuclear threats. Most civil defence shelters are in residential buildings’ basements (The Finnish National Rescue Association 2023a). It is advisable to have the ‘necessary drugs, first aid supplies and iodine tablets’ at home as part of the home emergency food supply (Finnish Red Cross 2023).