Abstract
Over the last 15 years, particular attention has been paid to the protection and security of so-called critical infrastructures, including drinking water distribution networks (WDN). Infrastructure managers are seeking to ensure their security and improve their resilience. However, the question of the economic efficiency and of the economic benefits provided by such measures remains open. The purpose of this article is to contribute to this debate. It presents the results of a Choice Experiment survey aimed at estimating the benefits of measures to protect against a potential cyberattack in the territory of Eurométropole de Strasbourg in France. The aggregate benefits of two resilience programs are assessed. They help make ‘optimal’ and informed decisions from a cost–benefit perspective.
HIGHLIGHTS
This article aims to contribute to the debate on the economic efficiency of measures taken to improve the resilience of WDN.
We investigate ex-ante measures aimed at reducing damage in the case of an extreme event occurring.
We base our study on the cyberattack scenario, a human-induced ever-increasing threat.
We conduct a Choice Experiment survey on users to assess their willingness-to-pay for resilience measures.
Aggregated benefits range from €1.07 million to €12.7 million depending on the program and its cost.
Graphical Abstract
INTRODUCTION
Over the last 15 years, and especially since the terrorist attacks on New York in 2001, special attention has been paid to the issues of protecting and ensuring the security of so-called critical infrastructures, including drinking water distribution networks (WDN) (Galland 2010). These infrastructures are generally faced with two distinct types of threat: climate change and extreme natural events (floods, drought, etc.) and wilful human-induced risks (unauthorised access to a facility, accidental or intentional contamination of water, etc.) (Haimes et al. 1998; Janke et al. 2014). This may not only damage the infrastructure itself, but can also (and perhaps more importantly) have severe impacts for business and residential users (Brozović et al. 2007). The consequences of failures may extend well beyond the losses of a WDN, and can affect the capacity of other infrastructures and systems to operate normally (Haimes et al. 1998). Water utilities, which are generally required to assess the vulnerability of their infrastructures (Benabid et al. 2012), are therefore taking an ever greater interest in the issues surrounding the qualitative and quantitative security of their water provision (Barbier 2011). Climate change emphasises the need to diversify sources of water supply and increase the number of interconnections. Water managers seek to secure their respective WDNs using telemetry, smart sensors, real-time data reporting and analysis (among others), all of which are measures intended to improve network resilience (Hall et al. 2019b).
Resilience is a polysemous word (de Bruijn et al. 2017; Johannessen & Wamsler 2017). It is defined in this article as the capacity of a system to recover its performance level following an abnormal disturbance (Werey et al. 2016). This approach refers to the four properties highlighted by Bruneau et al. (2003), namely the robustness (capacity to avoid dysfunctions), redundancy (capacity to reduce their technical and functional impacts), rapidity (capacity to recover a performant level of service as soon as possible following a dysfunction) and resourcefulness (ability to mobilise the necessary resources).
Resilience constitutes a turning point in risk management since it is not a question of managing impacts once they occur, but rather one of coping with the event (Boin & McConnell 2007). The emergence of these issues opens up new avenues of research, namely the economic efficiency of measures aimed at making WDN more resilient, and the benefits they provide (Environment Agency 2015). This article aims to fill this gap by contributing to the debate on the economic efficiency of measures taken to improve the resilience of critical infrastructures.
The present paper is original on several counts. Firstly, it explores the views and perceptions of people who use infrastructures, that is those who may be impacted in the event of service interruption or malfunction. As such, it endeavours to provide decision makers with important insights about users' preferences and benefits provided by resilience measures. Our work makes use of a monetary valuation method, the Choice Experiment (CE) (Louviere 1988; Bennett & Blamey 2001), which involves conducting a survey on users of the drinking water supply service to assess their Willingness-To-Pay (WTP) for resilience measures.
This study also focuses on resilience, i.e. assisting decision makers to decide between a public policy on protection that improves crisis response or one that promotes ex-ante measures aimed at reducing impacts. There is a broad body of literature covering users' WTP for increases in water supply reliability to mitigate climate-induced impacts on water resources (e.g. Howe & Smith 1993; Howe et al. 1994; Griffin & Mjelde 2000; Koss & Khawaja 2001; Hensher et al. 2005b, 2006; Tapsuwan et al. 2014; del Saz-Salazar et al. 2016; Appiah et al. 2019; Cooper et al. 2019; Islam et al. 2019). However, we found very few studies relating to WTP to improve the resilience of critical infrastructure. Some examples of these are Maliszewski et al. (2013), Thacker et al. (2018) and Baik et al. (2020) who examined the electricity sector and Wang et al. (2018) who considered the transportation system in New York City. Regarding WDN, Brozović et al. (2007) used the Contingent Valuation Method (CVM) to estimate WTP to avoid water supply interruption in the case of earthquake. More recently, Price et al. (2019) used CE to assess Canadian households' WTP for avoiding service disruptions in the case of flood events. However, these studies focused on the WTP to reduce the likelihood that an event will occur (i.e. of a risk reduction), whereas we are investigating ex-ante measures aimed at reducing damage in the case of an extreme event occurring, which has more to do with adaptation issues.
While other studies mentioned consider natural disasters (hurricanes for Wang et al. (2018), earthquake for Brozović et al. (2007), flooding for Thacker et al. (2018) and Price et al. (2019), very cold winter weather for Baik et al. (2020)), this work focuses on a man-made risk, namely a cyberattack. Our starting point was the fact that while protection against natural risks is crucial, cybersecurity attacks are an ever-increasing threat (Clark et al. 2017) that deserve further examination. As noted by Haimes et al. (1998) the ‘consequences of a terrorist act […] could be compared to the potential consequences of catastrophic natural hazards, possibly to those with exceedingly large return periods’. Finally, the attack in question targets the WDN of a French metropolitan area, that is to say the infrastructure itself, while other studies mainly deal with the impacts of catastrophic events on a territory (a city for instance) and not specifically on a critical infrastructure. A growing body of research estimates users' WTP for green infrastructures as a way to enhance the resilience of a city (Adegun 2017; Wang et al. 2017; Zalejska-Jonsson et al. 2020; to quote just a few recent examples).
The remainder of this article is structured as follows. The second section presents the methods. The third section presents the results. A discussion and a conclusion are proposed respectively in the fourth and fifth sections.
MATERIALS AND METHODS
The survey was conducted in the territory of the Eurométropole de Strasbourg. It aims to identify users' preferences regarding and Willingness-To-Pay for different measures designed to improve the resilience of the WDN.
Study area
The Eurométropole de Strasbourg is a French metropolitan area located close to the German border in the north-east of France. It was created on 4 December 1967 under the name ‘Communauté Urbaine de Strasbourg’ and became a metropolis by the law of 27 January 2014 on the modernisation of territorial public action and the affirmation of metropolitan areas. Since 1 January 2017, the territory has been made up of 33 municipalities, covering a total area of 339.64 km2.
The Eurométropole de Strasbourg is the authority responsible for public water and sanitation services for all the municipalities. On 31 December 2016, it was in charge of the maintenance and operation of drinking water production and distribution equipment in 12 municipalities, under its own management, for a total of 426,819 inhabitants (48,920 customers). The drinking water production and distribution system of the remaining 16 municipalities (58,103 inhabitants for 18,824 customers) was operated by the Syndicat des Eaux et de l'Assainissement Alsace-Moselle (SDEA) (Figure 1). Volumes billed were respectively 26.633 million and 3.612 million m3 (data from Eurométropole de Strasbourg (2017)).
The territory of the Eurométropole de Strasbourg (Eurométropole de Strasbourg 2017) on 1 January 2017.
The territory of the Eurométropole de Strasbourg (Eurométropole de Strasbourg 2017) on 1 January 2017.
The total WDN is 1,476 km long, mainly made up of 200 mm diameter pipes, made mainly of cast-iron. The water is abstracted from the Alsace water table, one of the largest in Europe. The Water and Sanitation Service of the Eurométropole de Strasbourg relies on four pumping stations, of which the Polygone catchment accounts for 80% of the supply, while also feeding into a storage tank. The average water price is €1.64 per m3 for 120 m3 in the municipalities supplied by the Eurométropole de Strasbourg, varying between €1.53 and €1.68 per m3 for 120 m3 in the sector supplied by the SDEA (data from Eurométropole de Strasbourg (2017)).
Creation of the scenarios and resilience programs
This work focuses on the preferences of Eurométropole de Strasbourg's inhabitants for improving the resilience of their WDN. The scenario assumes a malicious attack on the Polygone pumping station, coupled with false data being fed into the monitoring system so that the utility does not notice, and does nothing to counter the drop in pressure. Such a cyberattack would likely lead to interruptions in water supply, or even a ban on using tap water for several days, while drinking water potability tests are carried out. Bottled water would then be handed out for free at different locations throughout the city. Some people regarded as ‘vulnerable’, i.e. the elderly and infirm, who cannot attend the water distribution points, or those who are not able to read or understand safety instructions, could be particularly affected.
Two resilience programs are studied. They are based on the implementation of ex-ante measures designed to achieve a rapid return to normal operating conditions, thus reducing the consequences of the cyberattack on the utility and on users. More specifically, this goal is addressed through the following:
The purchase of dedicated equipment such as smart water meters or sensors able to swiftly identify errors and inconsistencies so that the utility is able to deal with them rapidly, and tablet computers to help locate ‘vulnerable’ people, etc.
The development of software to provide a clearer picture of how the WDN works.
Training programs for staff in improved risk management and the care of vulnerable people, etc., so that they can intervene more quickly and more effectively.
Raising awareness among users and local populations about what they should do in the event of a network malfunction.
These measures would be implemented and coordinated by the Prefect, the Mayor and the water utility.
The resilience programs are compared with the status quo, i.e. the way the utility would deal with the attack based on its current practices, organisation, reaction capacity and effectiveness, etc.
The Choice Experiment method
Choice Experiment (Louviere 1988; Bennett & Blamey 2001) is a monetary valuation method used to reliably place a monetary value on non-market goods and services. It is an extension of the well-known CVM. Both are based on preferences stated during a survey. However, instead of presenting the respondent with a single scenario involving the provision of a good or service, at a given cost, CE asks respondents to choose a single preferred option from two or more alternatives built as a bundle of different characteristics, called ‘attributes’. CE is grounded in Lancaster's characteristics demand theory (1966) which states that consumers derive utility not from a good itself but from the various characteristics of this good.
CE may have weaknesses, chiefly the fact that surveys are cognitively demanding (Hess & Daly 2014). However, bearing in mind the recommendations regarding its application (Johnston et al. 2017), we favoured this approach for a variety of reasons. First, while the avoided cost method or revealed reference methods would be easier and least costly to apply, they could not be used in our case, as we aim to value the resilience programs in conditions that do not currently exist. In other words, data that record people's actual choices (Champ et al. 2017) do not exist in the cases that interest us, meaning that we need to rely on hypothetical scenarios. Furthermore, contrary to the above-mentioned approaches, CE assesses both use and non-use values (Bennett 2011), and considers both the tangible and intangible impacts of a potential form of damage. Additionally, we wanted to cover all the dimensions of the disaster. Second, compared with CVM, CE encourages respondents to concentrate on the trade-offs between characteristics rather than taking a position for or against resilience measures (Champ et al. 2017). CE also makes it possible to identify the trade-offs individuals make between the different consequences of resilience measures (Hess & Daly 2014) and as such provides policy-relevant information about what is important for people.
Experimental design
The first stage in designing a CE questionnaire involves selecting the relevant attributes to describe the good or service under study, in our case resilience programs, and their levels (Johnston et al. 2017). Given the very limited research literature on the subject, five attributes were selected after discussion with the Water and Sanitation Service of the Eurométropole de Strasbourg (Table 1). They represent the impacts of a cyberattack, which can be significant to varying degrees, according to the level of resilience measures implemented.
Attributes and their levels
Attributes . | Description . | Levels . | ||
---|---|---|---|---|
PERS | Number of people affected by the malfunction |
| ||
COUP | Duration of water service interruption |
| ||
REST | Duration of restrictions on water consumption (drinking and cooking) |
| ||
SENS | Services for vulnerable people |
| ||
COST | Cost per household (paid in a lump-sum) |
|
|
|
Attributes . | Description . | Levels . | ||
---|---|---|---|---|
PERS | Number of people affected by the malfunction |
| ||
COUP | Duration of water service interruption |
| ||
REST | Duration of restrictions on water consumption (drinking and cooking) |
| ||
SENS | Services for vulnerable people |
| ||
COST | Cost per household (paid in a lump-sum) |
|
|
|
Each attribute was then assigned levels. To do this, we considered two resilience programs:
An intermediate-level resilience program ‘R + ’ based on the implementation of higher technical security solutions than those which currently exist, namely improved and more robust hydraulic models, ‘smart’ and optimally placed monitoring tools (sensors, flowmeters and water meters), etc. This reflects level 2 of the attributes.
A high-level resilience program ‘R + +’, which goes beyond R+ in that it also makes use of human capacities (for example, training of employees of the water utility in crisis management, increased communication with users, etc.) and ensures the security of the supervision system. R ++ would permit a return to normal operating conditions more quickly than R+. It corresponds to level 3 of the attributes.
The software NGene was used to create a D-efficient design for the survey (Hensher et al. 2005a) through a fractional factorial design (Rose et al. 2007). The 15 choice sets created in this way were then split into three versions of the questionnaire (Louviere 1988), so that, at the end, each respondent was presented with five choice sets.
Each choice set offers two alternative resilience options and the zero-cost status quo (Table 2). Each respondent had to choose his preferred option and the method assumes that he/she will select the one that provides him/her with the highest level of utility.
Questionnaire and data collection
The questionnaire was made up of six parts. The first two aimed to identify respondents' attitudes toward the environment (priorities in the allocation of public funds, main issues in terms of water management and drinking water supply, etc.) and their water consumption habits (water uses, time of consumption, bottled water use, water bill, etc.). The third part concentrated on their perception of water quality in the Eurométropole de Strasbourg and associated health risks. The fourth part focused on their appreciation of the water supply service (current performance, perception of the risks incurred by the utility and its users, past experience of malfunctions, etc.). The fifth part was the choice sets along with the follow-up questions. The last part aimed at collecting the socio-economic characteristics of respondents (municipality of residence, age and level of education, household income, household structure including the presence of vulnerable consumers, etc.).
The valuation scenario first presented the vulnerability of the water utility in the face of cyberattacks, the impacts that such a malicious act would have on the populations concerned, and the preventive measures which could be implemented. The benefits of the hypothetical resilience programs were then depicted (i.e. the attributes) and the implementing and coordinating stakeholders (Prefect, Mayor and water utility) explicitly mentioned, as well as the payment vehicle. For half of the questionnaires selected at random, some explanations of how the choice sets work were provided. Finally, just before presenting the choice sets, the respondent was reminded of his/her budget constraints with a short cheap-talk script (Cummings & Taylor 1999).
This questionnaire was tested in February and March 2018. It was conducted face-to-face in May 2018. Sampling is based on two stratification variables: (i) the municipality of residence (Strasbourg/other municipalities supplied by the Eurométropole de Strasbourg/municipalities supplied by the SDEA) and (ii) the household structure (single persons/childless couples/other situations). A total of 512 people were consulted, of whom 485 completed the valuation exercise.
The majority (56%) of respondents are women. The mean age is 35 years, and a comparison of means test shows that people living in municipalities supplied by the Eurométropole de Strasbourg are significantly younger (34 against 39 years), due in part to the city's large student population. This is confirmed by the fact that education levels are significantly lower in these municipalities (significant chi-square statistic). However, respondents are generally well-educated, since 80% of them hold a bachelor's degree, and 35% of them have completed at least three years of undergraduate studies. The mean income is €2,123 per household per month. A majority of respondents were not familiar with survey topics, with only 17% stating that they worked or studied in the environmental field, 15% in risk management, and 9% in water management. The share of people working in the health sector is slightly higher (27%). Finally, almost one third of respondents are members of associations. Of those, 14% belong to an environmental protection association, and 28% have made donations to environmental protection associations in the last five years.
RESULTS
Specification of the utility function




The specification of the econometric model used to model this probability depends on what assumptions are made about the distribution of the . In the McFadden conditional logit (1974), which originates from random utility theory, the error terms are independent and identically distributed (iid) with Gumbel distribution.










The explanatory variables of the conditional logit are the sole attribute levels, i.e. choices are modelled as a function of choice sets' characteristics, with the basic levels being used as the reference. The multinomial logit makes it possible to go further and introduce the socio-economic variables, that is to say the chooser's characteristics. While the log-likelihood remains identical to that of the conditional logit, the odd-ratio does not always satisfy the IIA assumption. In addition, the iid property of the error terms may potentially be violated. Other models such as the latent class logit or the mixed logit may be used to capture preference heterogeneity across individuals; however, a multinomial logit that includes one discriminating and highly significant socio-economic variable will provide results of adequate quality and an appropriate level of details for the purposes of this study.
To eliminate potential misinterpretation related to traditional binary coding, as well as determining coefficients of the attribute reference levels, we applied effect coding to the attributes with qualitative levels (Bech & Gyrd-Hansen 2005).
Econometric modelling
Table 3 provides the results of the logit multinomial. The analysis was performed using the R package ‘mlogit’ (Croissant 2020). The model fit is indicated by the McFadden pseudo-R2 (Hanemann & Kanninen 1999) which is not bad in practice since it equals 0.11 whereas it should ideally be between 0.2 and 0.4 (Hensher & Johnson 1981). A relatively large proportion of respondents' choices can thus be explained through attribute levels alone.
Results of the conditional logit
Variables . | Coeff. . | Std. Err. . |
---|---|---|
PERS2 | 0.13*** | 0.05 |
PERS3 | − 0.08* | 0.05 |
COUP2 | 0.09* | 0.05 |
COUP3 | 0.12*** | 0.05 |
REST2 | 0.04 | 0.04 |
REST3 | 0.22*** | 0.04 |
SENS2 | 0.25*** | 0.04 |
SENS3 | 0.57*** | 0.04 |
COST | − 0.03*** | 0.00 |
ASC1 | − 0.47*** | 0.15 |
ALT_STBG1 | 0.35*** | 0.11 |
ASC2 | − 0.53*** | 0.15 |
ALT_STBG2 | 0.30** | 0.11 |
Number of observations | 2,303 | |
Log-likelihood | − 2,256.5 | |
McFadden pseudo-R2 | 0.11 |
Variables . | Coeff. . | Std. Err. . |
---|---|---|
PERS2 | 0.13*** | 0.05 |
PERS3 | − 0.08* | 0.05 |
COUP2 | 0.09* | 0.05 |
COUP3 | 0.12*** | 0.05 |
REST2 | 0.04 | 0.04 |
REST3 | 0.22*** | 0.04 |
SENS2 | 0.25*** | 0.04 |
SENS3 | 0.57*** | 0.04 |
COST | − 0.03*** | 0.00 |
ASC1 | − 0.47*** | 0.15 |
ALT_STBG1 | 0.35*** | 0.11 |
ASC2 | − 0.53*** | 0.15 |
ALT_STBG2 | 0.30** | 0.11 |
Number of observations | 2,303 | |
Log-likelihood | − 2,256.5 | |
McFadden pseudo-R2 | 0.11 |
Statistical significance levels are indicated as follows: * = 10%; ** = 5%; *** = 1%.
The coefficients of PERS3 and REST2 are not significantly different from (0). In other words, the fact that 400,000 inhabitants are affected by the malfunction, and that the restrictions on water consumption remain in place for five days, do not influence respondents' choices. The coefficient of COST is significant and negative. As expected, this attribute negatively affects the probability of choosing an alternative rather than the reference situation.
The Alternative Specific Constants (ASC), which capture the effect of the variations among choices not taken into account by the attributes, are negative. This means that not choosing the reference situation reduces utility, a reduction which is then theoretically compensated by the presence of the attributes. This result highlights the existence of a status quo bias (Kahneman et al. 1991; Meyerhoff & Liebe 2009). The coefficients of STBG are also significant and negative. The inhabitants of Strasbourg thus have a higher probability of choosing alternatives 1 or 2 rather than the reference situation, i.e. a higher probability of choosing a resilience program.

They are proposed in Table 4. Only the coefficient of SENS1 is significantly different from . The presence of the other lower attribute levels in an alternative does not influence the probability of choosing it.
Coefficients of the lower attribute levels
Attribute levels . | Coeff. . | Std. Err. . |
---|---|---|
PERS1 | − 0.04 | 0.22 |
COUP1 | − 0.21 | 0.22 |
REST1 | − 0.25 | 0.21 |
SENS1 | − 0.83*** | 0.23 |
Attribute levels . | Coeff. . | Std. Err. . |
---|---|---|
PERS1 | − 0.04 | 0.22 |
COUP1 | − 0.21 | 0.22 |
REST1 | − 0.25 | 0.21 |
SENS1 | − 0.83*** | 0.23 |
Statistical significance levels are indicated as follows: *** = 1%.
The calculation of these coefficients also allows for a comparison of the value of the different variations in resilience improvement. Consequently, for each attribute, we can check whether the coefficients increase with the level. This is actually the case for all attributes, except for the number of people affected by the malfunction. The fact that an alternative reduces the number of people affected to 10,000 reduces its probability of selection. This result is surprising insofar as this is the highest level of PERS. It could be due to the existence of a threshold in respondents' preferences.
Estimation of the benefits provided by resilience programs
We now estimate the benefits given by the two resilience programs R+ and R++. As a reminder, all non-monetary attributes take their intermediate levels in R+ (PERS2, COUP2, REST2 and SENS2) and their higher levels in R ++ (PERS3, COUP3, REST3 and SENS3). The reference situation with which they are compared is a status quo described by the lower levels of the non-monetary attributes (PERS1, COUP1, REST1 and SENS1). It is proposed at no cost ().



Indirect utility associated with the status quo


This value is negative, that is to say that the current situation in which the utilities take no additional preventive measures provides a loss of well-being.
The indirect utility and surplus variations associated with the resilience programs
Equations (7) and (8) are also used to calculate the indirect utilities provided by the resilience programs. They were applied for the different levels of the COST attribute, since the objective was not to calculate the benefits provided by a scenario presented during the survey, but by the resilience programs, and we do not know at what cost they would be implemented.


These calculations were made with either ASC1 or ASC2, to reflect the fact that the resilience scenarios could have been presented in Alternative 1 or Alternative 2. The results are substantially similar so that we have adopted a ‘conservative’ approach (Mitchell & Carson 1989) and have included in Table 5 only the lowest values; they refer to ASC2.
Indirect utilities, individual surplus variations and aggregated benefits for R+ and R++
. | COST levels . | R + . | R + + . |
---|---|---|---|
Indirect utility VR | COST = 10 | − 0.11 | 0.22 |
COST = 20 | − 0.39 | −0.05 | |
COST = 30 | − 0.66 | −0.33 | |
COST = 40 | − 0.93 | −0.60 | |
COST = 50 | − 1.21 | −0.87 | |
Variations in individual surplus CSi | COST = 10 | 44.80 | 58.94 |
COST = 20 | 34.80 | 48.94 | |
COST = 30 | 24.80 | 38.94 | |
COST = 40 | 14.80 | 28.94 | |
COST = 50 | 4.80 | 18.94 | |
Aggregated benefits CS | COST = 10 | 9,988,808 | 12,696,144 |
COST = 20 | 7,759,258 | 10,466,594 | |
COST = 30 | 5,529,708 | 8,237,044 | |
COST = 40 | 3,300,158 | 6,007,494 | |
COST = 50 | 1,070,608 | 3,777,944 |
. | COST levels . | R + . | R + + . |
---|---|---|---|
Indirect utility VR | COST = 10 | − 0.11 | 0.22 |
COST = 20 | − 0.39 | −0.05 | |
COST = 30 | − 0.66 | −0.33 | |
COST = 40 | − 0.93 | −0.60 | |
COST = 50 | − 1.21 | −0.87 | |
Variations in individual surplus CSi | COST = 10 | 44.80 | 58.94 |
COST = 20 | 34.80 | 48.94 | |
COST = 30 | 24.80 | 38.94 | |
COST = 40 | 14.80 | 28.94 | |
COST = 50 | 4.80 | 18.94 | |
Aggregated benefits CS | COST = 10 | 9,988,808 | 12,696,144 |
COST = 20 | 7,759,258 | 10,466,594 | |
COST = 30 | 5,529,708 | 8,237,044 | |
COST = 40 | 3,300,158 | 6,007,494 | |
COST = 50 | 1,070,608 | 3,777,944 |
The variations of individual surplus are then calculated using Equation (5). This involves the marginal utility of the monetary attribute. It provides the WTP of an average household for the resilience programs, according to the levels of the attributes being considered. As previously, this is calculated for the different levels of COST. Results show that welfare gains are higher with R ++ than with R+. This was to be expected, since R ++ contains more stringent measures aimed at improving the resilience of the WDN. Whatever the level of COST, respondents agree to pay to benefit from further technical solutions. These WTP range from €4.80 to €44.80 per household depending on the level of the monetary attribute. They are also willing to pay for optimised technical solutions, a more secure supervision system, better training for staff and user awareness programs. These WTP range from €18.94 to €58.94 per household depending on the level of the monetary attribute.
Aggregation of the benefits

Table 5 provides the results.
DISCUSSION
Implications for policies
The aggregated benefits provided by the resilience programs in the Eurométropole de Strasbourg are positive and (logically) decrease with the level of the monetary attribute, i.e. what households would have to pay for the implementation of resilience programs. They range from €1.07 to €12.7 million depending on the program and its cost (let us recall that this is a lump-sum payment). As expected, the benefits provided by the intermediate program R+ are lower than those provided by the more advanced program R++.
As a comparison, the annual water bill for a consumption of 120 m3, which corresponds to the average annual consumption in France (Barbier & Montginoul 2013), was €343 in 2018 in the territory of the Eurométropole de Strasbourg. Of this amount, around €193 relates to drinking water (subscription, consumption and taxes and charges). These values are well above the estimated WTP, which range from €4.80 to €44.80 per household for R+ and from €18.94 to €58.94 per household for R++, depending on the level of the monetary attribute. Paying to implement the resilience measures may therefore be regarded as acceptable to users, especially if payments are spread out in time. R+ at least may be envisaged. It is reasonable to assume that damage, disruption, and reconstruction costs in the case of a crisis without extra protective measures would be very high, and could greatly outweigh the investment costs in resilience programs (Hall et al. 2019a). R++ might also be set up assuming that, for instance, it allows greater efficiency in the operation of the service.
Strengths and limitations of data collection and methodology
Choice Experiment, which is used in this study, is a powerful methodology for estimating the monetary value of non-market goods and services. It provides credible estimates and rich insights for decision-making. The methodology used does, however, have some limitations that need to be acknowledged, the most important relating to data collection. Indeed, as the Eurométropole de Strasbourg covers a vast area, the survey had to be administered in strategically chosen locations, such as shopping centres, railway stations, etc. A potential bias in the selection of respondents may in consequence have occurred. For instance, those who took the train more often were more likely to participate in the study. To prevent this risk, we relied on trained, skilled, and qualified personnel. One in ten people who passed by the surveyors was asked to participate in the investigation. Surveyors were at the various sites at different times of the day, and on different days of the week. Interviewing was also guided by quotas based on cities to respect specific local conditions.
Another limitation of many CE studies has to do with questionnaire design. In our case, there were no problems with understanding or acceptance of scenarios. The questionnaire had been previously tested and then modified to rephrase biased, leading questions, or eliminate pointless ones. We had no negative feedback regarding the final version. Also, follow-up questions used to explore the motivations behind the answers given and examining the credibility of the valuation scenario (Bennett & Blamey 2001) show that the questionnaire and scenarios were properly designed and well understood. Specifically, they show that:
- (i)
a majority of respondents think that the probability of a cyberattack occurring in their municipality within the next five years is low, a result that could call into question the credibility of our scenarios (Johnston et al. 2017), but very few rank it as very low and, more importantly, this was somehow expected since cyberattacks are a relatively new form of risk;
- (ii)
only a very limited number of respondents did not attach particular importance to an attribute, which is what is expected of them (Campbell et al. 2008);
- (iii)
the same holds true for protest behaviours, i.e. respondents who protest against some aspect of the scenarios (Meyerhoff & Liebe 2008);
- (iv)
the majority of respondents are confident in the effectiveness of the proposed resilience measures in countering the impacts of a cyberattack and in the ability of the utility to implement them.
CONCLUSION
This article presents an assessment of the aggregated benefits of two programs aimed at improving the resilience of a WDN subject to a cyberattack. The survey was conducted on inhabitants of the Eurométropole de Strasbourg in France.
Our results suggest that the benefits are high, which shows the appeal of this assessment since, as they lack market value, one would have reasonably assumed they had no value at all (Champ et al. 2017). They also highlight the fact that residents understand, perceive and attach value to issues related to human-induced risks. This finding responds to an essential issue, since the likelihood of cyberattacks may well increase in the future (Clark et al. 2017). It is therefore important in that it informs decision makers, and is crucial to their making the right decisions at the right times. Basing our study on the cyberattack scenario also enabled us to undertake a first assessment of inhabitants' WTP for improving the resilience of WDNs in the face of a human-induced risk, without water being intentionally contaminated. The latter may indeed have led to biased responses due to its highly anxiogenic nature.
This outcome is a first step. Coupled with an assessment of the costs these resilience measures would incur for the utility, these aggregate benefits provide information for making an ‘optimal’ decision from a cost–benefit point of view. Indeed, offsetting the cost of implementation against their benefits provides for a basis to consider the economic efficiency of these actions, i.e. the best balance between the means and the results. Questions may arise, for example, as to whether the implementation of resilience programs would lead to increased efficiency and enhance service improvements. This calls for further development to provide stakeholders with a clearer picture. It also highlights the need to address what people are willing to pay to mitigate other types of risks (e.g. intentional contamination of water), for the protection of other critical infrastructures which may fall victim to cyberattacks, such as nuclear power plants, as well as the mitigation of the so-called ‘domino effect’, whereby disruption to one infrastructure can spread to a myriad of other infrastructures.
ACKNOWLEDGEMENTS
This work is part of the Franco-German ResiWater project (‘Innovative Secure Sensor Networks and Model-based Assessment Tools for Increased Resilience of Water Infrastructures’) funded by ANR and BMBF under the call ‘Protection of Critical Infrastructures PICS 2014’. The author would like to thank Caty Werey of INRAE as well as Nathalie Pasquet, Jean-Marc Weber and Marc Baruthio of Eurométropole de Strasbourg for their advice and comments with questionnaire design and data collection.