Research and analysis

The Smart Street Infrastructure Security Report: executive summary

Published 23 June 2022

Introduction

The smart street infrastructure security report sets out to explore the physical security landscape of street infrastructure, with a primary focus on telecom devices on street lighting columns and to identify areas where best practice and standards could improve the security of the assets.

Incorporating a mixed methodology research approach, this study utilised both qualitative and quantitative research methods to understand the landscape, identify options to enhance physical security, and validate findings with key stakeholders.

Key findings

To date, limited physical security measures have been employed on the majority of lighting columns in the UK. This is not surprising as their traditional purpose has been to provide lighting in areas to enhance public safety. Whilst there have been occasional attacks on lighting columns, the primary challenges to their operation have been road traffic accidents (RTAs) or damage caused by petty vandalism.

The standards landscape study has identified 30 highly relevant standards. Of these, nine standards relate to lighting columns; however, these only consider structural safety of the column and not security aspects of the equipment attached to the columns. The rest of the highly relevant standards cover a variety of items such as locks, risk management guidelines and electronic security systems.

There is no specific physical security committee developing standards in relation to smart street infrastructure and telecommunications equipment (including 5G).

With the move to consider them as platforms for a kaleidoscope of ancillary technologies, their risk of damage through deliberate assault is increased. Whilst this report is primarily focused on the ability to deploy and operate 5G technologies on multi-functional lighting columns, there is no doubt that the presence of other wireless connectivity technologies (as well as technologies such as CCTV, EV charging, etc.) may also increase the risk of assault in the future.

This has been observed by private sector operators of street-based masts, poles and other telecommunications providers and it is reasonable to assume that multi-functional lighting columns will be similarly targeted. Indeed, there is a growing body of evidence of lighting columns being attacked because of the presence, or presumed presence, of 5G telecommunications technology.

An enhanced level of physical security is therefore deemed to be required to protect both the assets, the ancillary technologies they host, and the services that those technologies deliver.

The key questions are therefore:

• What measures should be deployed?
• On what basis?
• Who (which organisations) should be responsible for determining the measures required?

Fundamental to determining the potential responses to these questions is the reality that a differentiated response is required to address lighting column assets already deployed in the public realm and new multi-functional lighting columns. The existing asset base presents a number of engineering, operational and contractual challenges as a programme of retrofit could be required.

Future multi-functional lighting columns could potentially have physical security measures incorporated into them by design and future procurement programmes designed to include more operational security measures.

The reality though is that the requirements are fundamentally different, and this report’s recommendations recognises this reality and offers a proposed approach to address both challenges.

Conclusions

This report has considered these questions and concluded as follows:

Overall

1. There is a need for additional guidance on physical security relating both to the existing estate of lighting columns, and the design of new multi-functional lighting columns.

2. The advent of multi-functional lighting columns and the increasing number of services that will be supported by them suggests that they will become more prone to attack.

3. Wherever possible, and specifically in relation to lighting columns used to host telecommunications equipment, physical security measures and recommendations should seek to adopt the principle of universality (i.e., minimising the number of keys maintenance organisations need to hold and manage whilst ensuring continued ease of access for security purposes). However, it needs to be recognised that access to keys must be proactively managed to ensure that only permitted organisations and personnel can access them.

4. Providing enhanced levels of physical security using a layered approach consistent with best practice physical security schemes employed elsewhere, is just one element of a holistic protection and maintenance operation. Consideration must also be given to the monitoring of assets, response requirements and timelines relating to an assault or incidence.

5. Given the increased number and type of ancillary technologies hosted on a variety of street-based assets, a more integrated approach to security of all street-based assets is potentially required. Existing contractual arrangements may need to be modified and/or consolidated.

For existing lighting columns

6. A challenge is the practicality and cost of any retrofit required and the impact on existing maintenance arrangements.

7. Any increase in physical security requirements will result in additional costs for assets already deployed. However, it is also likely that costs associated with repair and replacement will reduce. Therefore, there is a need for a different/revised business case model to account for these. Work will also be necessary to determine where any additional costs and savings will most logically fall.

8. It is recognised that wherever possible, any revision of requirements for existing deployed assets should be as ‘light touch’ as is possible to minimise both retrofit costs and revisions to existing maintenance operations/contractual arrangements.

For new multi-functional lighting columns

9. Development needs to be applied to include many more security by design measures. The ambition must be to future-proof new multi-functional column designs as far as possible and to be able to accommodate a portfolio of different physical security measures.

10. New assets may also result in higher acquisition and/or operation costs but these should hopefully be lower than the cost of retrofitting existing assets. Again, these should also result in lower repair and replacement costs. Revised business models will therefore need to consider full lifecycle costs of acquisition, operation and maintenance.

Other ancillary devices/street-based assets

11. This thinking needs to extend beyond the providers of wireless connectivity to other potential ancillary equipment suppliers regarding the physical security measures they may require in future where their equipment is deployed, and their services consumed.

12. Whatever the outcomes of this initiative, consideration needs to be given to extending the findings to all public realm located street furniture/assets which could host a kaleidoscope of the different ancillary technologies.

Recommendations

A detailed series of recommendations which addresses these findings are included in Section 8 of the full report and included below. They are made on the assumption that the two PASs will be specifically tasked to address them as part of the overall scope.

For both PASs

1. A formal methodology for assessing risk and assigning a security rating to a site or existing lighting column is developed. This could be in the form of a downloadable template.

2. A best practise layered security methodology is developed and approved by key stakeholders involved in the deployment of lighting columns and the attachment of ancillary devices to them.

3. A baseline portfolio of approved physical security measures by layer is defined and agreed.

4. A matrix which matches the security rating and the selection of physical security measures should be developed and agreed. This could be in the form of a downloadable template.

5. The organisation responsible for undertaking risk assessment and security rating assignment is agreed. This could be accompanied with an agreed RACI Matrix to ensure that all relevant stakeholders are engaged in the process

For PAS 1 (Design specification of multi-functional lighting columns)

6. A suggested minimum physical security specification is defined. This could be based upon, but not constrained by, the baseline portfolio proposed.

For PAS 2 (Code of practice for the assessment of lighting columns for multi-functional use)

7. A business case template to assess the cost of retrofit for required physical security measures is suggested for consideration in the requirements for PAS R2. Plus a code of practice for the assessment of lighting columns for multi-functional use.

General recommendations

8. Ofcom could be approached regarding their ability to become the central repository and oversight organisation for the assessment and security assignment reports. Ofcom regulates the communications operators whose equipment is the cause of the enhanced risks to the street furniture and therefore would be a logical organisation to take on this role and responsibility.

General considerations

9. A decision should be made regarding the application of the recommended approaches to all ancillary devices and street base assets. At the very least, suppliers of ancillary devices should be requested to specify what physical security measures they require on the hosting platforms and make a financial provision to fund any costs in upgrading the platform to match their requirements.

10. Local authorities conduct a review of all arrangements relating to physical security for street-based assets and consolidate those arrangements wherever possible.

Next steps

This initiative follows and complements a study for WM5G as part of the DCMS funded Urban Connected Communities (UCC) programme to assess and codify associated best practice relating to smart street infrastructure. The Phase 3 Report1 to WM5G made two specific recommendations for immediate standardisation needs of publicly available specifications (PASs):

1. R1. Develop a PAS design specification of multi-functional lighting columns (“Design PAS”). The technology and components for smart street infrastructure are quickly evolving through advancements in technology and market demands. A design specification will help local authorities (LAs) to understand what smart lighting columns are needed to support their long-term community plan, and their capability to offer interoperable components to make a valid assessment as to what lighting columns meet their current and future demand needs.

2. R2. PAS code of practice for the assessment of lighting columns for multi-functional use (“Appraisal PAS”). This PAS will support decision making whether existing lighting columns are suitable to be connected, and potentially upgraded with minor modifications, to accommodate 5G technologies and other uses including EV (electric vehicles) charging, hosting cameras, Internet of Things (IoT) sensors, advertising banners and street signage.

Initial proposals for both standards were provided via WM5G to DCMS for investment consideration and these have now been commissioned for delivery in 2022/2023. The findings in this report further validates the need for the two proposed PASs and provides valuable insight and data to inform and refine their development.