Published on 25 September 2023
Two and a half years after its launch, the European project IMPETUS has delivered an eponymous platform dedicated to improving the security of smart cities. The IMPETUS platform incorporates eight tools combining cutting-edge technologies, ethical considerations and operational recommendations for security centers.
The city of the future will be digital, and therefore vulnerable. How can we improve its cybersecurity and resilience? This is the aim of the European IMPETUS project.
Flying taxi cabs may not yet be filling the skies, but the intelligent, adaptive city of the future is already a reality. A little more so each day, with technology improving city dwellers’ daily lives by managing and controlling buildings, street furniture, water systems, electricity grids and transport systems. This massive digitalization not only exposes smart cities to cyber-attacks, but also opens up a new field of action in terms of security. Drawing on this urban fabric of connected objects and services, multiple technological solutions can be put in place to monitor and protect smart cities.
Launched in 2021, the European Horizon 2020 project named “IMPETUS” focused on developing a range of these control and prevention technologies, seeking not only to overcome operational obstacles, but also to address the ethical issues associated with their implementation. This project culminated two and a half years later in the production of a platform, also named IMPETUS, integrating technological, ethical and decision-making functions. This global platform for the security of smart cities incorporates eight tools, each associated with an action procedure for Security Operator Centers (SOC), as well as a detailed practical guide.
This range of tools covers a wide range of technological solutions acting at different levels: detecting emergencies requiring immediate response, identifying potential or emerging threats, managing crisis situations, providing cyber-protection, and guaranteeing operational efficiency. Two Institut Mines-Télécom schools were involved in the development of these tools: IMT Mines Alès for airborne bacteria detection (Bacteria Detector), and Télécom SudParis for the Cyber Threat Detection and Response tool. The latter also oversaw the ethical assessment of the tools, and the drafting of the practical guide.
Some of the IMPETUS tools already existed and were developed to higher levels of maturity, while others were brand new. One example was the biological risk security tool developed by Sandrine Bayle, a researcher at IMT Mines Alès, and her team. “We innovated by embracing a paradigm shift in relation to other commercially available tools that focus on finding known pathogenic organisms,” she explains. “We adopted the principle that in the event of an attack, the perpetrators are likely to release a large quantity of microorganisms. So we decided to measure the concentration of all the microorganisms present in the air and assess the moment at which this concentration becomes abnormal and poses a potential risk.”
This gives the tool a greater chance of detecting an attack by an unknown strain, or one considered non-pathogenic in small concentrations. “The experience gained from COVID-19 showed that to destabilize a city, you don’t need to affect everyone, with a few sick people being all it takes to generate malfunctions and, above all, create panic,” adds the researcher. The measurement of airborne concentrations is based on determining the dosage of adenosine triphosphate (ATP), a molecule common to all microorganisms. ATP measurement is commonly used for rapid diagnoses of water systems, to check whether air-conditioning systems are contaminated by legionella in the summer, for example. Sandrine Bayle and her team then sought to define an air quality alert threshold.
The operational effectiveness of the tool, and of the IMPETUS platform in general, was verified at the end of the project by conducting two real-life simulation exercises in the smart cities of Oslo and Padua. The members of the consortium tested the platform in a scenario in which a series of different alerts (protest, presence of an armed person in a crowd, terrorist attack and simulation of a bacteriological attack) were triggered over a period of two to three hours. The aim was to activate the various tools and observe their implementation, especially in terms of their ability to warn SOCs in order to initiate a response.
IMPETUS is a platform incorporating eight monitoring and decision-support tools plus a practical guide, designed to ensure the safety of smart cities. Credits: IMPETUS website
These simulations also enabled the researchers to take stock of the data collected by each tool, and their compliance with the legal and technical framework. “Today, as soon as a new technology emerges, we need to consider the ethical consequences of its implementation. It is essential to create or upgrade our tools with technological building blocks that comply with the legal constraints in terms of ethics and privacy,” stresses Nesrine Kaaniche, a researcher at Télécom SudParis who oversaw a cross-functional working group focusing on the identification and management of risks linked to the collection of personal data by IMPETUS tools.
“Right at the start of the project, we identified the tools processing sensitive data and the regulations that might apply to them,” adds the researcher. All the technologies used by IMPETUS were therefore subject to a Privacy Impact Assessment (PIA), a best practice validated by the European Union Agency for Cybersecurity (ENISA), to ensure that private information would be consistently treated with respect.
The data collected by certain tools, such as the firearm detector based on connected cameras, is certainly sensitive: “These cameras are constantly filming, but we have ensured that the images are only consulted and stored when a firearm is detected,” maintains Nesrine Kaaniche. “Similarly, for the social media detection tool, identifying data is anonymized and stored in encrypted form.” In the light of her work on this cross-disciplinary subject, the researcher was consulted throughout the project by the consortium members in charge of developing a specific tool: “Thanks to this, we were in more of a validation phase than a compliance phase at the time of the simulations. In the end, all the tools met the required standards.”
Convinced by the work carried out on ethical and privacy issues, the IMPETUS Scientific and Technical Coordinator asked Télécom SudParis to conduct similar analyses on the cybersecurity and operational aspects of the tools during the course of the project. The results of this work have been published in the form of a practical online guide, called Practitioners Guides, intended for IMPETUS platform users (operational staff, politicians, etc.). “SINTEF [editor’s note: the project’s coordinating organization] came up with the idea of an online platform to accommodate all of the project’s results. The project partners could enter the information themselves, and we took over the coordination,” explains Joaquin Garcia-Alfaro, a researcher at Télécom SudParis who oversaw the Practitioners Guides.
The Practitioners Guides compile all the regulatory and practical information relating to the various tools on the IMPETUS platform. Credits: IMPETUS website
This platform is a veritable mine of information on global challenges and the applicable regulations; each tool is presented with its context of use, the specific issues that apply to it, the type of sensitive data that may be collected, and recommendations. In addition to documentation, the site also hosts video resources and webinars.
Now that the IMPETUS project has ended, an analysis of the strengths and weaknesses of each solution has been published on the project website, and the consortium members will all continue to develop their own tools. “For our part, we will continue to improve our detection system for applications other than the risk of massive terrorist attacks, in agri-food factories or waste processing sites, for example, in order to assess whether staff need to be protected,” announces Sandrine Bayle. The Practitioners Guides are a valuable legacy that Télécom SudParis would like to preserve. “There has been talk of publishing all the content related to the IMPETUS project in a book, in the form of a collection of articles,” says Joaquin Garcia-Alfaro. “Whatever happens, we’d like to maintain this space, and even develop it, perhaps by updating it with the results of future projects.”
The IMPETUS project was launched on September 1st, 2020 and ended on February 28th, 2023. It received €8 million in European Union funding (agreement 883286) divided between 18 research consortium partners in France, Italy, Spain, Belgium, Switzerland, the Netherlands, Croatia, Norway, Romania, Estonia and Israel. All the results of the IMPETUS project are published on the project website: https://www.impetus-project.eu/
DENV-R, a data center on water