The Coverage Gap: Chile’s critical infrastructure against the USA, EU and UK

Among the OIVs operating infrastructure with real-world physical impact — energy, health, banking, telecommunications, fuels, water, transport and state administration — fewer than ten publish a verifiable disclosure channel. The four largest banks and both incumbent telecommunications carriers lack one entirely.

“The coverage gap does not measure how secure Chile’s critical infrastructure is. It measures something more precise: whether the next vulnerability someone discovers has anywhere to go. Today, for 98.3% of the regulated perimeter, it does not.”

David Mellafe Z. · Reizan · Independent Security Research

Email authentication (SPF / DKIM / DMARC) is, in practical terms, what prevents a criminal from sending emails that appear to come from the exact domain of a trusted institution. When it is misconfigured across the vast majority of the regulated perimeter, the door is left open to impersonation (phishing) campaigns that spoof banks and state services to defraud the public.

This is not a theoretical risk: the fraudulent emails impersonating Chilean banking and public institutions — a phenomenon the public faces daily and that cybersecurity authorities have repeatedly warned about — rely precisely on this structural weakness. The 84% misconfiguration rate is not an abstract technical figure: it is the condition that lets impersonation fraud keep operating.

The study compares Chile with five jurisdictions that have an established public cybersecurity authority and a binding or comply-or-explain mandate. In each, disclosure-channel coverage across the critical-infrastructure perimeter exceeds 90% — in every case, after a binding regulatory intervention. In Chile, with the framework in place but without that intervention, the equivalent figure is 1.7%.

The eight-year lag is not a sentence. The leading countries show that, with a binding mandate equivalent to CISA’s Directive 18-01, the gap closes in twelve to twenty-four months. Chile arrives late, but for exactly that reason it can compress nearly a decade of regulatory iteration into a single step, adopting international best practice directly. The study proposes a low-cost closure roadmap that ANCI could activate within its existing statutory authority, with no need for legislative action.

Comparability note: the universes compared are not strictly equivalent (they differ in size, definition and measurement method). The comparison should be read as a directional gap on the dimension of email-authentication mandates, not as an exact quantitative delta. Full detail is in the paper.

The study is independent academic research. It has no client, was not commissioned by the State or by any operator, and does not sell a product to the entities it measures. That independence is deliberate and verifiable:

The analysis was carried out exclusively through observation of public information, with no interaction with operators’ systems beyond what an ordinary website visitor would do. It is framed in line with the principles of ISO/IEC 29147:2018 on responsible disclosure and within the bounds of Law 21.459 (Chile’s computer-crimes statute). Consistent with that responsible-disclosure practice, the study reports only aggregate figures across the full OIV set: it names no individual operator, so the document informs public policy without functioning as a target list.

The 915 OIVs are not abstract entities: they are the hospitals, banks, power transmission companies, telecommunications carriers, water utilities and state agencies on which the daily life of every Chilean depends. The study documents that the financial and telecommunications sectors — far from leading — concentrate the most severe findings, and that the health sector shows the highest density of findings relative to its size, consistent with its well-recognized underfunding.

The gap matters because it determines the fate of the next vulnerability discovered in any of those organizations. When no defined reporting channel exists, a legitimate finding from a good-faith researcher simply falls on the floor — or, in the worst case, ends up on the gray market. The study frames the present moment as a window of opportunity: the conditions to implement and adopt a disclosure mandate are most favorable right now, while the regulated perimeter is not yet the target of mass attack campaigns.

The full paper (in English) is the canonical academic artifact and the source of truth for all figures and methodology. This summary is distributed under the same attribution terms (CC-BY-4.0).

← Back to research