2011/2284(INI)

Critical information infrastructure protection. Achievements and next steps: towards global cyber-security

Procedure completed

General
Activities
Documents
Votes
Amendments (90)
History

2011/2284(INI) Critical information infrastructure protection. Achievements and next steps: towards global cyber-security

Role	Committee	Rapporteur	Shadows
Opinion	AFET
Lead	ITRE	KALFIN Ivailo (S&D)	VAN NISTELROOIJ Lambert (EPP), CREUTZMANN Jürgen (ALDE), TOŠENOVSKÝ Evžen (ECR), TZAVELA Niki (EFD)
Opinion	LIBE	HANKISS Ágnes (EPP)

Lead committee dossier: ITRE/7/06163

Subjects

Links

Activites

2012/06/12 Text adopted by Parliament, single reading
- T7-0237/2012
2012/06/11 Debate in Parliament
2012/06/11 Prev DG PRES
- DG {u'url': u'http://ec.europa.eu/dgs/information_society/index_en.htm', u'title': u'Information Society and Media'}, KROES Neelie
2012/05/16 Committee report tabled for plenary, single reading
- A7-0167/2012 summary
  
  The Committee on Industry, Research and Energy adopted the own-initiative report drafted by Ivailo KALFIN (S&D, BG) on critical information infrastructure protection achievements and next steps: towards global cyber-security. Members recall that the impact of the internet and ICT on various aspects of citizens lives is increasing rapidly. They are crucial drivers for social interaction, cultural enrichment and economic growth. A proper level of information security is critical for robust expansion of internet based services. It is for this reason that Members propose a draft resolution proposing a framework for protection at three levels: national, European and international, which may summarised as follows: I. Measures to reinforce CIIP at national and Union level: Members welcome the Member States implementation of the European Programme for CIIP, including the setting-up of the Critical Infrastructure Warning Information Network (CIWIN). The CIIP efforts will not only enhance the overall security of citizens but also improve citizens perception of security and their trust in measures adopted by government to protect them. Members call for existing measures to be strengthened, such as: extending the scope of Council Directive 2008/114/EC, notably by including the ICT sector and financial services as well as health, food and water supply systems, nuclear research and industry (where these are not covered by specific provisions); enhancing European excellence in the area of CIIP; updating of minimum resilience standards for preparedness and reaction against disruptions, incidents, destruction attempts or attacks; supporting cooperation between public and private stakeholders at Union level, and encourage their efforts to develop and implement standards for security and resilience for civilian (whether public, private or public-private) national and European critical information infrastructure; emphasising the importance of pan-European exercises in preparation for large-scale network security incidents. Moreover, Members call on the Commission, in cooperation with the Member States, to assess the implementation of the CIIP action plan; urges the Member States to establish well-functioning national/governmental CERTs, develop national cyber security strategies, organise regular national and pan-European cyber incident exercises, develop national cyber incident contingency plans and contribute to the development of a European cyber incident contingency plan by the end of 2012. They recommend that operator security plans or equivalent measures be put in place for all European critical information infrastructures, and that security liaison officers be appointed. II. Further EU activities for robust internet security: the report urges ENISA to coordinate and implement annual EU Internet Security Awareness Months, so that issues relating to cyber-security become a special focus for the Member States and EU citizens. It calls on the agency to consult relevant stakeholders with a view to defining similar cyber-security measures for owners and operators of private networks and infrastructure, as well as to assist the Commission and Member States in contributing to the development and uptake of information security certification schemes, norms of behaviour and cooperation practices among national and European CERTs and owners and operators of infrastructure as and where needed through the definition of technologically neutral common minimum requirements. ENISA is called upon to: manage a number of executive tasks at EU level, and, in cooperation with US counterparts, tasks related to the prevention and detection of network and information security incidents and enhancing cooperation among the Member States (in particular in the framework of the revision of the ENISA Regulation); obtain additional responsibilities related to the response to internet attacks ; maintain the exercises carried out in 2010 and 2011 on its agenda and progressively involve relevant private operators. The report calls on the Member States to set up national cyber incident contingency plans and to include key elements such as relevant contact points, provisions of assistance, containment and repair in the event of cyber disruptions or attacks with regional, national or cross-border relevance. There should be better coordination among competent national authorities to make their actions more coherent. At EU level, the Commission is called upon to: propose binding measures via the EU cyber incident contingency plan for better coordination at EU level of the technical and steering functions of the national and governmental CERTs; take, along with the Member States, the necessary measures in order to protect critical infrastructure from cyber attacks and to provide ways of hermetically cutting off access to a critical infrastructure if a direct cyber attack poses a severe threat to its proper functioning; propose binding measures designed to impose minimum standards on security and resilience and improve coordination among national CERTs. Members call on the Member States and the EU institutions to assure the existence of well-functioning CERTs, featuring minimum security and resilience capabilities based on agreed best practices. They point out that national CERTs should be part of an effective network in which relevant information is exchanged in accordance with the necessary standards of confidentiality. Furthermore, they call for the establishment of a 24/7 continuity of CIIP service for each Member State, as well as the setting-up of a common European emergency protocol to be applicable between the national contact points. Common procedure: the report calls on the Commission to suggest a common procedure for identification and designation of a common approach to tackle cross-border ICT threats, with the Member States being expected to provide the Commission with generic information concerning the risks and threats to, and the vulnerabilities of, their critical information infrastructure. It welcomes the Commissions initiative of developing a European Information Sharing and Alert System by 2013. Members welcome the various stakeholder consultations on internet security and CIIP initiated by the Commission. They suggest that the Commission launch a public pan-European education initiative, geared towards educating and raising awareness among both private and business end-users about potential threats on the internet and fixed and mobile ICT devices at every level of the utility chain and towards promoting safer individual online behaviours. Comprehensive internet security strategy: Members call on the Commission to propose, by the end of 2012, a comprehensive internet security strategy for the Union, based on clear terminology. This should aim at creating a cyberspace (supported by a secure and resilient infrastructure and open standards) which is conducive to innovation and prosperity through the free flow of information, while ensuring robust protection of privacy and other civil liberties. Members maintain that the strategy should detail the principles, goals, methods, instruments and policies (both internal and external) necessary in order to streamline national and EU efforts, and to establish minimum resilience standards among the Member States. Minimum standards for security measures or the education of individual users, businesses and public institutions, and reactive measures, such as criminal-law, civil-law and administrative sanctions should be introduced. The Commission should propose a robust mechanism to coordinate the implementation and regular updating of the internet security strategy. The Commission is urged to improve the availability of statistically representative data on the costs of cyber attacks in the EU. This mechanism should be supported by sufficient administrative, expert and financial resources. In addition, they call for: a proposal for an EU framework for the notification of security breaches in critical sectors such as energy, transport, water and food supply, as well as in the ICT and financial services sectors; the improvement of the availability of statistically representative data on the costs of cyber attacks in the EU, the Member States and industry ; measures to avoid impeding the growth of the European internet economy and include the necessary incentives in order to exploit the potential of business and public-private partnerships to the full; a legislative proposal for further criminalising cyber attacks (i.e. spear-phishing, online fraud, etc.). III. International Cooperation: Members recall that international cooperation is the core instrument for introducing effective cyber-security measures. However, at present, the EU is not actively involved on an ongoing basis in international cooperation processes and dialogues relating to cybersecurity. Members calls on the Commission and the European External Action Service (EEAS) to start a constructive dialogue with all like-minded countries with a view to developing a common understanding and policies with the aim of increasing the resilience of the internet and of critical infrastructure. They maintain that, at the same time, the EU should, on a permanent basis, include internet security issues in the scope of its external relations and that ongoing activities performed by various international and EU institutions, bodies and agencies as well as Member States require coordination in order to avoid duplication. Welcoming the creation, at the November 2010 EU-US Summit, of the EU-US Working Group on Cyber-security and Cyber-crime and the common programme and a roadmap towards joint/synchronised transcontinental cyber-exercises in 2012/2013, Members suggest establishing a structured dialogue between EU and US legislators in order to discuss internet-related issues as part of a search for common understanding, interpretation and positions. Lastly, Members urge the EEAS and the Commission, on the basis of the work done by the European Forum of Member States, to secure an active position within the relevant international forums, inter alia by coordinating the positions of the Member States with a view to promoting the EUs core values, goals and policies in the field of internet security and resilience; notes that such forums include NATO, the UN, the Internet Corporation for Assigned Names and Numbers, the Internet Assigned Numbers Authority, the OSCE, the OECD and the World Bank. They encourage the Commission and ENISA to participate in the main stakeholder dialogues to define technical and legal norms in cyberspace at an international level.
2012/05/08 Vote in committee, 1st reading/single reading
- AFET
- ITRE ITRE/7/06163 KALFIN Ivailo S&D
- LIBE HANKISS Ágnes EPP
2012/03/20 Prev Adopt in Cte
2012/03/05 Deadline Amendments
2012/02/07 Committee draft report
- PE474.017
2011/11/17 Committee referral announced in Parliament, 1st reading/single reading
- AFET
- ITRE ITRE/7/06163 KALFIN Ivailo S&D
- LIBE HANKISS Ágnes EPP
2011/11/10 EP officialisation
2011/03/31 Date
2011/03/31 Non-legislative basic document
- COM(2011)0163 summary
  
  PURPOSE: to take stock of the results achieved since the adoption of the Critical Information Infrastructure Protection (CIIP) action plan and describe the next steps planned for each action. BACKGROUND: the Commission adopted on 30 March 2009 a communication on Critical Information Infrastructure Protection (the CIIP action plan) to strengthen the security and resilience of vital Information and Communication Technology (ICT) infrastructures. The aim was to stimulate and support the development of a high level of preparedness, security and resilience capabilities both at national and European level. The action plan is built on five pillars: preparedness and prevention, detection and response, mitigation and recovery, international cooperation and criteria for European Critical Infrastructures in the field of ICT. At the same time the Digital Agenda for Europe, adopted in May 2010, emphasises the need for all stakeholders to join their forces in a holistic effort to ensure the security and resilience of ICT infrastructures, by focusing on prevention, preparedness and awareness, as well as developing effective and coordinated mechanisms to respond to new and increasingly sophisticated forms of cyber-attacks and cyber-crime. Complementing this, the Commission tabled a proposal for a new mandate to strengthen and modernise the European Network and Information Security Agency (ENISA) in order to boost trust and network security. This Communication takes stock of the results achieved since the adoption of the CIIP action plan in 2009. It describes the next steps planned for each action at both European and international level. It also focuses on the global dimension of the challenges and the importance of boosting cooperation among Member States and the private sector at national, European and international level, in order to address global interdependencies. CONTENT: the Communication begins by identifying the potential threats which may disrupt access to information networks. In order to gain a more comprehensive understanding of these various threats, it can be useful to regroup them along the following categories: exploitation purposes, such as "advanced persistent threats" for economic and political espionage purposes (e.g. GhostNet), identity theft, the recent attacks against the Emissions Trading System etc; disruption purposes, such as Distributed Denial of Service attacks or spamming generated via botnets (e.g. the Conficker network of 7 million machines) ; destruction purposes, which is a scenario that has not yet materialised but, cannot be ruled out for the years to come. In order to counter these threats, the Commission highlights some of the actions it has taken: 1) Preparedness and prevention: · the establishment of the European Forum of Member States (EFMS) made significant progress in fostering discussion and exchanges related to security and resilience of ICT infrastructures; · the European Public-Private Partnership for Resilience (EP3R) aims at fostering the cooperation between the public and the private sectors on strategic EU security and resilience policy issues; · the creation of a network of well-functioning National/Governmental CERTs in all Member States by 2012, which will be the backbone of the European Information Sharing and Alert System (EISAS) for citizens and SMEs. 2) Detection and response: ENISA devised a high-level roadmap for the development of a European Information Sharing and Alert System (EISAS) by 2013. 3) Mitigation and recovery: so far only 12 Member States that have organised exercises for large-scale network security incident response and disaster recovery. The first pan-European exercise on large-scale network security incidents (Cyber Europe 2010) took place on 4 November 2010 with the involvement of all Member States, plus Switzerland, Norway and Iceland. Future pan-European cyber exercises would undoubtedly benefit from a common framework. 4) International cooperation: the Commission will discuss and promote the principles with relevant stakeholders, in particular the private sector (via EP3R), bilaterally with key international partners, in particular the US, as well as multilaterally. It will do so, within its competences, in fora such as G8, OECD, NATO, etc. 5) Criteria for European Critical Infrastructures in the ICT sector: the technical discussion in EFMS led to a first draft of the ICT sector-specific criteria for identifying European Critical Infrastructures, with a focus on fixed and mobile communications and the Internet. The technical discussion will continue and benefit from the consultations on the draft criteria, at national and European (via EP3R) level, with the private sector. The Commission will also discuss with Member States the ICT sector- specific elements to be considered for the review of the Directive on the identification and designation of European critical infrastructures and the assessment of the need to improve their protection in 2012. Next steps: in the face of global challenges, the Commission will: · promote principles for the resilience and stability of the Internet: international principles for the resilience and stability of the Internet should be developed with other countries, with international organisations and, where appropriate, with global private- sector organisations by using existing fora and processes, such as those related to Internet Governance. These principles should serve as a tool for all stakeholders to frame their activities, relating to the stability and resilience of the Internet; · build strategic international partnerships: strategic partnerships should be built on ongoing efforts in critical areas, like cyber-incident management, including exercises and cooperation among CERTs. The engagement of the private sector, which operates on a global scale, is of paramount importance. The EU-U.S. Working Group on Cyber-security and Cyber-crime is an important step in this direction. The Working Group will focus on cyber incident management, public-private partnerships, awareness raising and cyber-crime. On the European side, key factors for success would be good coordination between all EU institutions, relevant agencies (in particular ENISA and Europol) and Member States. · develop trust in the cloud: it is essential to strengthen discussions on the best governance strategies for emerging technologies with a global impact, such as cloud computing. Member States are called upon to: · enhance EU preparedness by establishing a network of well functioning National/Governmental CERTs by 2012. This activity will also advance the development of a European Information Sharing and Alert System (EISAS) to the wider public by 2013; · establish a European cyber-incident contingency plan by 2012 and regular pan-European cyber exercises. Future pan-European cyber exercises should be based on a European cyber incident contingency plan that builds upon and interlinks with national contingency plans. Such a plan should provide the baseline mechanisms and procedure for communications between Member States and, last but not least, support the scoping and organisation of future pan-European exercises. ENISA will work with Member States on the development of such a European cyber incident contingency plan by 2012; · ensure European coordinated efforts in international fora and discussions on enhancing security and resilience of Internet. Member States should cooperate together and with the Commission on promoting the development of an approach based on principles or norms to the issue of the global stability and resilience of the Internet. It should be noted than an Annex to the Communication gives a detailed overview of achievements of the CIIP action plan as well as the next steps.
- DG {u'url': u'http://ec.europa.eu/dgs/information_society/index_en.htm', u'title': u'Information Society and Media'}, KROES Neelie

Documents

Non-legislative basic document published: COM(2011)0163
Committee draft report: PE474.017
Committee report tabled for plenary, single reading: A7-0167/2012
Decision by Parliament, 1st reading/single reading: T7-0237/2012

Votes

A7-0167/2012 - Ivailo Kalfin - § 16/2

2012/06/12

Position	Total	ALDE	ECR	EFD	GUE/NGL	NI	PPE	S&D	Verts/ALE	correctional
For	571	79	48	18	0	10	254	162	0	1
Against	108	1	1	8	26	10	0	10	52	0
Abstain	16	0	1	0	0	8	1	5	1	0

A7-0167/2012 - Ivailo Kalfin - § 26/2

2012/06/12

Position	Total	ALDE	ECR	EFD	GUE/NGL	NI	PPE	S&D	Verts/ALE	correctional
For	571	78	49	18	0	5	254	166	1	1
Against	98	1	0	8	20	14	0	2	53	0
Abstain	24	1	1	0	5	9	0	8	0	0

A7-0167/2012 - Ivailo Kalfin - § 39/2

2012/06/12

Position	Total	ALDE	ECR	EFD	GUE/NGL	NI	PPE	S&D	Verts/ALE	correctional
For	519	76	2	15	2	4	254	166	0	1
Against	95	3	1	9	7	15	0	7	53	0
Abstain	79	0	46	2	17	8	0	5	1	0

A7-0167/2012 - Ivailo Kalfin - Considérant A/2

2012/06/12

Position	Total	ALDE	ECR	EFD	GUE/NGL	NI	PPE	S&D	Verts/ALE	correctional
For	573	76	49	17	2	10	253	164	2	1
Against	87	3	0	8	6	14	0	4	52	1
Abstain	32	0	1	1	18	4	1	7	0	1

A7-0167/2012 - Ivailo Kalfin - Recital A/2

2012/06/12

Position	Total	ALDE	ECR	EFD	GUE/NGL	NI	PPE	S&D	Verts/ALE	correctional
For	573	76	49	17	2	10	253	164	2	1
Against	87	3	0	8	6	14	0	4	52	1
Abstain	32	0	1	1	18	4	1	7	0	1

A7-0167/2012 - Ivailo Kalfin - Considérant G/2

2012/06/12

Position	Total	ALDE	ECR	EFD	GUE/NGL	NI	PPE	S&D	Verts/ALE	correctional
For	581	78	49	17	2	10	254	171	0	1
Against	89	2	0	8	18	7	0	2	52	0
Abstain	24	0	1	1	6	11	0	4	1	0

A7-0167/2012 - Ivailo Kalfin - Recital G/2

2012/06/12

Position	Total	ALDE	ECR	EFD	GUE/NGL	NI	PPE	S&D	Verts/ALE	correctional
For	581	78	49	17	2	10	254	171	0	1
Against	89	2	0	8	18	7	0	2	52	0
Abstain	24	0	1	1	6	11	0	4	1	0

A7-0167/2012 - Ivailo Kalfin - Considérant K/2

2012/06/12

Position	Total	ALDE	ECR	EFD	GUE/NGL	NI	PPE	S&D	Verts/ALE	correctional
For	568	76	49	11	2	8	252	168	2	1
Against	84	4	0	8	7	11	0	3	51	0
Abstain	42	0	1	7	17	9	2	6	0	0

A7-0167/2012 - Ivailo Kalfin - Recital K/2

2012/06/12

Position	Total	ALDE	ECR	EFD	GUE/NGL	NI	PPE	S&D	Verts/ALE	correctional
For	568	76	49	11	2	8	252	168	2	1
Against	84	4	0	8	7	11	0	3	51	0
Abstain	42	0	1	7	17	9	2	6	0	0

A7-0167/2012 - Ivailo Kalfin - Résolution

2012/06/12

Position	Total	ALDE	ECR	EFD	GUE/NGL	NI	PPE	S&D	Verts/ALE	correctional
For	573	77	50	17	1	7	252	169	0	1
Against	90	2	0	8	18	10	0	2	50	0
Abstain	26	1	0	0	7	10	1	4	3	0

A7-0167/2012 - Ivailo Kalfin - Resolution

2012/06/12

Position	Total	ALDE	ECR	EFD	GUE/NGL	NI	PPE	S&D	Verts/ALE	correctional
For	573	77	50	17	1	7	252	169	0	1
Against	90	2	0	8	18	10	0	2	50	0
Abstain	26	1	0	0	7	10	1	4	3	0

Amendments	Dossier
90	2011/2284(INI) Critical information infrastructure protection. Achievements and next steps: towards global cyber-security 2012/02/29 LIBE 23 amendments... Amendment 1 # Ioan ENCIU Draft opinion Paragraph 1 1. Considers that the protection of critical information infrastructure requires an interdisciplinary approach that needs to include the important aspects of civil liberties, justice and home affairs such as internal security, personal data protection and the right to confidentiality and a private life; Amendment 2 # Kinga GÖNCZ Draft opinion Paragraph 1 1. Considers that the protection of critical information infrastructure requires an interdisciplinary approach that needs to include the important aspects of civil liberties, justice and home affairs, namely enhancing security while respecting fundamental rights; Amendment 3 # Rolandas PAKSAS Draft opinion Paragraph 1 a (new) 1a. Stresses that the EU should provide strong leadership and unify all stakeholders so as to take effective action to protect Europe from possible threats to its critical information infrastructures; Amendment 4 # Ioan ENCIU Draft opinion Paragraph 3 3. Urges that the identification of European Critical Infrastructure be completed and continuously updated under the supervision of the Commission, in accordance with Directive 2008/114; stresses also the need to create the Critical Infrastructure Warning Information Network (CIWIN) at a European level as soon as possible; Amendment 5 # Monika HOHLMEIER Draft opinion Paragraph 3 a (new) 3 a. insists that in view of the strong dependency of public institutions, businesses and private households on Information and Communication Technologies (ICT) the Council Directive 2008/114/EC (on the identification and designation of European critical infrastructures and the assessment of the need to improve their protection) should be reviewed in order to also recognise ICT as a critical sector; Amendment 6 # Rolandas PAKSAS Draft opinion Paragraph 4 4. UCalls on the Member States to develop a national strategy and ensure a solid policy-making and regulatory environment, comprehensive risk management procedures and appropriate preparatory measures and mechanisms; urges the Member States that have not founded their national CERT (Computer Emergency Response Team) to found it in due course, with the assistance of ENISA, if needed; Amendment 7 # Kinga GÖNCZ Draft opinion Paragraph 5 5. Takes the view that any large-scale database handling sensitive personal data, such as those of the EU, Member State governments and financial and healthcare institutions, should be considered to be part of the critical information infrastructure and the protection of such data should be ensured according to the highest possible standards; Amendment 8 # Alexander ALVARO Draft opinion Paragraph 5 a (new) 5 a. Calls on the Commission and the Member States to take the necessary measures in order to protect critical infrastructure from cyber attacks and provide for means to hermetically cut off access to a critical infrastructure in case a direct cyber attack severely threatens its proper functioning; Amendment 9 # Ioan ENCIU Draft opinion Paragraph 6 a (new) 6a. Considers that ENISA can fulfil a key role at a European level concerning the protection of critical information infrastructures by providing technical expertise to Member States and European Union institutions and bodies, as well as reports and analyses concerning information system security at European and global level; Amendment 10 # Ioan ENCIU Draft opinion Paragraph 7 7. Believes that international cooperation beyond the EU is indispensable, as the nature of cyber-threats is global, requiring global responses; stresses also that any international agreement involving the exchange of sensitive data should take into consideration the security of data transfer and storage; Amendment 11 # Valdemar TOMAŠEVSKI Draft opinion Paragraph 7 7. believes that international cooperation beyond the EU is indispensable, as the nature of cyber-threats is global, requiring global responses that comply with the provisions of international law; Amendment 12 # Monika HOHLMEIER Draft opinion Paragraph 7 a (new) 7 a. emphasises that the upcoming "Internet Security Strategy" by the Commission should take the work on CIIP as a central point of reference and aim for a holistic and systematic approach towards cyber security by including both proactive measures, such as the introduction of minimum standards for security measures or the teaching of individual users, businesses and public institutions, and reactive measures, such as criminal, civil and administrative sanctions; Amendment 13 # Ioan ENCIU Draft opinion Paragraph 8 8. Believes that coo~~rdin~~peration ~~within the EU~~ should be strengthened and enhanced ~~first and foremost between civilian and military actors~~between the judicial and other competent authorities in preventing, combating and penalising attacks against information systems, including the police and other law enforcement authorities from the Member States, as well as specialised agencies at a European level, such as Eurojust, Europol, ENISA; Amendment 14 # Rui TAVARES Draft opinion Paragraph 8 8. Believes that coordination within the EU should be strengthened and enhanced ~~first and foremost between civilian and military actors~~between all actors involved; Amendment 15 # Kinga GÖNCZ Draft opinion Paragraph 9 9. Emphasises the importance of strong cooperation between the public and the private sectors, as the different strengths of the sectors should contribute, through mutual complementation, to the efforts made to protect the infrastructure and thus the lives and privacy of European citizens; Amendment 16 # Rolandas PAKSAS Draft opinion Paragraph 9 9. Emphasises the importance of strong cooperation between the public and the private sectors, as the different strengths of the sectors should contribute, through mutual complementation, to the efforts made to protect the infrastructure and thus the lives of European citizens; calls on the Commission to establish the European Public-Private Partnership for Resilience, which would be integrated with the work of the European Network and Information Security Agency (ENISA) and the European Government CERTs Group; Amendment 17 # Roberta ANGELILLI Draft opinion Paragraph 10 a (new) 10 a. Considers that the efforts in the protection of Critical Information Infrastructures will not only enhance overall security of citizens but will improve also the citizens' perception of security and their trust in measures adopted by Government to protect them; Amendment 18 # Roberta ANGELILLI Draft opinion Paragraph 10 b (new) 10 b. Emphasises the importance of establishing and ensuring a durable integration of European Research to maintain and strengthen the European excellence in the area of Critical Information Infrastructure Protection; Amendment 19 # Roberta ANGELILLI Draft opinion Paragraph 10 c (new) 10 c. Emphasises the importance of an active research roadmap in the area of cyber-security; Amendment 20 # Roberta ANGELILLI Draft opinion Paragraph 10 d (new) 10 d. Promotes cyber-security education (PhD student internships, university courses, workshops, training for students, etc...) and specialized training exercises in Critical Information Infrastructure Protection; Amendment 21 # Roberta ANGELILLI Draft opinion Paragraph 10 e (new) 10 e. Enhances a close relationship and interaction between National Private Sector and ENISA to interface the National/Governmental CERTs with EISAS evolution; Amendment 22 # Roberta ANGELILLI Draft opinion Paragraph 10 f (new) 10 f. Emphasizes the importance of a common European Cyber Security Strategy and articulate a timeline for its definition in terms of actions and needed resources; Amendment 23 # Roberta ANGELILLI Draft opinion Paragraph 10 g (new) 10 g. Underlines the importance about a structured dialogue between EU - US joint transcontinental CIIP's main players and legislators for common understanding, interpretation and position on legal and governance frameworks. source: PE-483.744 2012/06/03 ITRE 67 amendments... Amendment 1 # Ivailo KALFIN Motion for a resolution Recital A A. whereas ~~information and communication technologies (~~the ICT) are able to deploy their full capacity for the advanc~~ing~~ement of the economy and the society only ifn case its users have a trust and confidence in their s~~afe~~ecurity and resilience, a~~nd if legislation on matters such as~~s well as when the existing legislation for data privacy ~~and~~, intellectual property rights ~~is enforced effectively in cyberspace~~, etc., is efficiently enforced in the Internet environment; Amendment 2 # Amelia ANDERSDOTTER Motion for a resolution Recital A A. whereas information and communication technologies (ICT) are able to deploy their full capacity for advancing the economy and society only if users have trust and confidence in their safety and resilience, and if legislation on matters such as data privacy ~~and intellectual property rights~~ is enforced effectively in cyberspace; Amendment 3 # Ivailo KALFIN Motion for a resolution Recital A a (new) Aa. whereas, Internet and Information and Communication Technologies (ICT) rapidly increase their impact on the various aspects of the citizens' lives, being a crucial driver for our social interaction, cultural enrichment and economic growth; Amendment 4 # Ivailo KALFIN Motion for a resolution Recital A b (new) Ab. whereas, ICT and Internet security is a comprehensive concept with a global incidence in economic, social, technological and military aspects, demanding a clear definition and differentiation of the responsibilities as well as a robust international cooperation mechanism; Amendment 5 # Ivailo KALFIN Motion for a resolution Recital A c (new) Ac. whereas, the EU Digital Agenda flagship aims at reinforcing Europe's competitiveness, based on strengthening ICT, and creating the conditions for high and robust growth and technology-based jobs; Amendment 6 # Ivailo KALFIN Motion for a resolution Recital A d (new) Ad. whereas, the private sector remains the first investor, owner and manager in information security products, provisions, services, applications and infrastructure, with billions of Euros invested over the last decade; whereas this involvement should be strengthened by appropriate policy strategies for promoting the resilience of public, private or public- private owned or operated infrastructures; Amendment 7 # Ivailo KALFIN Motion for a resolution Recital B B. whereas, developing a highly level of secureity and resilientce of the ICT networks, services and technologies ~~makes the EU economy more competitive~~shall increase the competitiveness of the European economy, both by improving cyber risk assessment and management, and by providing the EU economy at large with more robust information infrastructures to support innovation and growth; Amendment 8 # Krišjānis KARIŅŠ Motion for a resolution Recital B B. whereas developing highly secure and resilient ICT networks, services and technologies makes the EU economy more competitive, creating new opportunities for enterprises to become more productive; Amendment 9 # Lambert van NISTELROOIJ Motion for a resolution Recital B a (new) Ba. Whereas available law enforcement crime data for cybercrimes — covering cyber-attacks, but also other types of online crime — suggest strong increases in various European countries; whereas however, statistically representative data concerning cyber attacks from both law enforcement and the CERT (computer emergency response team) community remains scarce and will need to be better aggregated in future, which will enable stronger responses from law enforcement across the EU and better inform legislative responses to ever evolving cyber threats; Amendment 10 # Ivailo KALFIN Motion for a resolution Recital B a (new) Ba. whereas, a proper level of information security is critical for robust expansion of Internet based services; Amendment 11 # Lambert van NISTELROOIJ Motion for a resolution Recital C C. whereas recent cyber-incidents, disruptions and attacks against EU institutions, industry and Member States' information infrastructure demonstrate the need to establish a robust, innovative and effective system of critical information infrastructure protection (CIIP), based on full international cooperation and minimum resilience standards among the Member States; Amendment 12 # Ivailo KALFIN Motion for a resolution Recital C a (new) Ca. whereas the rapid development of new avenues of ICT such as Cloud computing, require a strong focus on the Internet security in order to be able to fully reap the benefits of the technological achievements; Amendment 13 # Ivailo KALFIN Motion for a resolution Recital C b (new) Cb. whereas the European Parliament has repeatedly insisted on applying high standards for data privacy and data protection, net neutrality and intellectual property rights protection; Amendment 14 # Ivailo KALFIN Motion for a resolution Recital C a (new) – Title 1 (new) I. MEASURES TO REINFORCE CIIP AT NATIONAL AND UNION LEVEL Amendment 15 # Ivailo KALFIN Motion for a resolution Paragraph 2 2. ~~Notes the positive developments since the implementation of Directive 2008/114/EC4 , and~~Acknowledges that the Commission is considering revision of Council Directive 2008/114/EC and calls for providing evidence of effectiveness and impact of the directive prior to undertaking further steps; calls for its scope to be expanded, notably by including the ICT sector and giving consideration to areas such as financial services, health, food and water supply systems, nuclear research and industry (where these are not covered by specific provisions); takes the view that these sectors should also ~~form par~~take the benefit of the cross-sectoral approach adopted by the CIWIN (consisting of cooperation, an alert system and the exchange of best practices); Amendment 16 # Lambert van NISTELROOIJ Motion for a resolution Paragraph 2 2. Notes the positive developments since the implementation of Directive 2008/114/EC4 , and calls for its scope to be expanded, notably by including the ICT sector and financial services, and giving consideration to areas such as ~~financial services,~~ health, food and water supply systems, nuclear research and industry (where these are not covered by specific provisions); takes the view that these sectors should also form part of the cross-sectoral approach adopted by the CIWIN (consisting of cooperation, an alert system and the exchange of best practices); Amendment 17 # Amelia ANDERSDOTTER Motion for a resolution Paragraph 3 3. Calls, in view of the inter-connected and highly interdependent, sensitive, strategic and vulnerable nature of national and EU CIIP, for the regular updating of minimum resilience standards to protect against any disruptions, incidents, destruction attempts or attacks, such as ~~distributed denial of service~~those resulting from insufficiently robust infrastructure or insufficiently secured end-terminals; Amendment 18 # Ivailo KALFIN Motion for a resolution Paragraph 3 3. Calls, in view of the inter-connected and highly interdependent, sensitive, strategic and vulnerable nature of national and E~~U CIIP, for the regular updating of minimum resilience standards to protect~~uropean Critical Information Infrastructures, for the regular updating of minimum standards for preparedness and reaction against any disruptions, incidents, destruction attempts or attacks, such as distributed denial of service; Amendment 19 # Silvia-Adriana ŢICĂU Motion for a resolution Paragraph 3 a (new) 3a. Emphasises the importance of information security standards and protocols and welcomes the 2011 mandating of CEN, CENELEC and ETSI to establish security standards; the list of priorities for the review of existing security standards (first stage) is aimed at standards on the protection of critical infrastructure such as the security of citizens, aviation security, border security, basic infrastructure and utilities security, the restoration of security and safety in crisis situations; Amendment 20 # Ivailo KALFIN Motion for a resolution Paragraph 3 a (new) 3a. Expects that Critical Information Infrastructures owners and operators shall enable and if necessary assist users to utilize the appropriate means for protecting them from malicious attacks and/or disruptions, through both human and automated supervision, where needed; Amendment 21 # Ivailo KALFIN Motion for a resolution Paragraph 3 b (new) 3b. Supports cooperation between public and private stakeholders at the Union level, and encourages their efforts to develop and take up standards for security and resilience for the civilian - public, private or public-private – national and European CII; Amendment 22 # Ivailo KALFIN Motion for a resolution Paragraph 3 c (new) 3c. Calls on the Commission, in cooperation with the Member States, to assess the implementation of the CIIP action plan; urges the Member States to establish well-functioning National/Governmental CERTs; develop national cyber security strategies; organise regular national and pan- European cyber incident exercises, develop national cyber incident contingency plans and contribute to the development of a European cyber incident contingency plan by the end of 2012; Amendment 23 # Ivailo KALFIN Motion for a resolution Paragraph 4 4. Recommends that operator security plans or equivalent measures be put in place for all European critical EU information infrastructures, and that security liaison officers be appointed; Amendment 24 # Ivailo KALFIN Motion for a resolution Paragraph 4 a (new) 4a. Welcomes the current review of the 2005/222/JHA Decision on attacks against information systems; Notes the need to coordinate the EU efforts in countering large-scale cyber-attacks, by including ENISA, Member States CERTs' and the future European CERT's competences; Amendment 25 # Ivailo KALFIN Motion for a resolution Paragraph 4 a (new) – Title 2 II. FURTHER EU ACTIVITIES FOR ROBUST INTERNET SECURITY Amendment 26 # Jürgen CREUTZMANN Motion for a resolution Paragraph 5 ~~5. Urges ENISA to coordinate and implement annual EU Internet Security Awareness Months, so that issues relating to cyber-security become a special focus for the Member States and EU citizens;~~deleted Amendment 27 # Ioan ENCIU Motion for a resolution Paragraph 5 5. Urges ENISA to elaborate analysis and reports concerning the situation of cyber- security at European and international level and to coordinate and implement annual EU Internet Security Awareness Months, so that issues relating to cyber- security become a special focus for the Member States and EU citizens; Amendment 28 # Ivailo KALFIN Motion for a resolution Paragraph 5 b (new) 5b. Supports ENISA, in line with the Digital Agenda goals, in exercising its duties with regard to network information security, and in particular by providing guidance and advising Member States how to meet the baseline capabilities for their CERTs, as well as to support the exchange of best practices through developing an environment of trust. Calls on the Agency to consult relevant stakeholders for defining similar cyber- security measures for private network and infrastructures owners/operators, as well as to assist the Commission and Member States in contributing to the development and uptake of information security certification schemes, norms of behaviour and cooperation practices among national- and European CERTs and infrastructure owners/operators as and where needed through the definition of technology neutral common minimum requirements; Amendment 29 # Ivailo KALFIN Motion for a resolution Paragraph 5 c (new) 5c. Welcomes the current proposal for review of the ENISA's mandate, in particular its extension and of the expansion of the tasks of the Agency. Believes that along with its assistance to Member States by providing expertise and analysis, ENISA should be entitled to manage a number of executive tasks at EU level, and in cooperation with the respective US counterparts, related to the prevention and detection of network and information security incidents and enhancing the cooperation among the member states. ENISA might also be assigned additional responsibilities, related to the response to Internet attacks to the extent that it brings a clear value added to the existing national response mechanisms. Amendment 30 # Ivailo KALFIN Motion for a resolution Paragraph 5 d (new) 5d. Welcomes the results of the 2010 and 2011 Pan-European Cybersecurity exercises, conducted across the Union and monitored by ENISA, whose goal was to assist Member States in designing, maintaining and testing a pan-European contingency plan. Calls on ENISA to maintain such exercises on its agenda and progressively involve relevant private operators as appropriate in order to increase Europe's overall Internet security capacities and looks forward to a further international expansion with like- minded partners; Amendment 31 # Ivailo KALFIN Motion for a resolution Paragraph 6 6. Calls on the EU Member States to set up national cyber~~-security~~ incident contingency plans, ~~which should~~to include key elements such as relevant contact points ~~and~~, provisions onf assistance, containment and repair in ~~the event~~case of cyber- disruptions or -attacks with cross-border relevance~~; notes that the~~. Member States should also put in place appropriate coordinating mechanisms/ structures at national level, which would help to ensure better coordination amongst competent national authorities, a~~nd make their actions more coherent;~~s well as greater coherence of their actions. Via the EU cyber incident contingency plan, suggests that the Commission proposes binding measures for better coordination at EU level of the technical and steering functions among the National/ Governmental CERTs. Amendment 32 # Silvia-Adriana ŢICĂU Motion for a resolution Paragraph 6 6. Calls on the Member States to set up national cyber-security contingency plans, which should include key elements such as relevant contact points and provisions on assistance, containment and repair in the event of cyber-disruptions or -attacks with regional, national or cross-border relevance; notes that the Member States should also put in place appropriate coordinating mechanisms/structures at national level, which would help to ensure better coordination among competent national authorities and make their actions more coherent; Amendment 33 # Silvia-Adriana ŢICĂU Motion for a resolution Paragraph 6 a (new) 6a. Emphasises that an inter-operative cross-border European system of ‘e-Governance’ is an integral part of the critical infrastructure of the European Union; requests that the necessary measures be implemented to ensure data protection and the protection of citizens’ privacy and to reduce vulnerability to cyber attacks to a minimum; Amendment 34 # Jürgen CREUTZMANN, Alexander ALVARO Motion for a resolution Paragraph 6 a (new) 6a. Calls on the Commission and the Member States to take the necessary measures in order to protect critical infrastructure from cyber attacks and provide for means to hermetically cut off access to a critical infrastructure in case a direct cyber attack severely threatens its proper functioning; Amendment 35 # Ioan ENCIU Motion for a resolution Paragraph 6 a (new) 6a. Looks forward for the full implementation of CERT-EU which will be a key factor in the prevention, detection, response and recovery from intentional and malicious cyber-attacks targeting the EU institutions; Amendment 36 # Ioan ENCIU Motion for a resolution Paragraph 7 7. Recommends that the Commission propose binding measures designed to impose minimum security standards and improve coordination among the ~~national CERTs~~institutions, agencies and bodies with competencies in the field of prevention, control and sanction of cybercrime; Amendment 37 # Amelia ANDERSDOTTER Motion for a resolution Paragraph 7 7. ~~Recommends that the Commission propose binding~~Urges ENISA to propose measures designed to impose minimum standards and improve coordination among the national CERTs; Amendment 38 # Jürgen CREUTZMANN Motion for a resolution Paragraph 7 7. Recommends that the Commission p~~ropose binding measures designed to impose~~ublish recommendations on minimum standards and improve coordination among the national CERTs; Amendment 39 # Ivailo KALFIN Motion for a resolution Paragraph 7 7. Recommends that the Commission propose binding measures designed to impose minimum standards on security and resilience and improve coordination among the national CERTs; Amendment 40 # Jürgen CREUTZMANN Motion for a resolution Paragraph 7 a (new) 7a. Calls on Member States and the EU institutions to assure the existence of well- functioning CERTs, featuring minimum security and resilience capabilities based on agreed best practices. National CERTs should be part of an effective network in which relevant information is exchanged in accordance with the necessary standards of confidentiality. Calls for the establishment of a 24/7 continuity of CIIP service for each Member State, as well as the setting up of a common European emergency protocol to be applicable between the national contact points; Amendment 41 # Ivailo KALFIN Motion for a resolution Paragraph 7 a (new) 7a. Calls on Member States and the EU institutions to assure the existence of well- functioning CERTs, featuring certain pre- defined binding minimum security and resilience capabilities. National CERTs should be part of an effective network in which relevant information is exchanged in accordance with the necessary standards of confidentiality. Calls for the establishment of a 24/7 continuity of CIIP service for each Member State, as well as the setting up of a common European emergency protocol (which could be part of the CIWIN), to be applicable between the national contact points; Amendment 42 # Ivailo KALFIN Motion for a resolution Paragraph 7 b (new) 7b. Underlines that building trust and promoting cooperation between Member States is crucial for protecting data and national networks and infrastructures; Calls on the Commission to suggest a common procedure for identification and designation of a common approach to tackle ICT cross border threats, expecting that the Members States provide to the Commission generic information concerning risks, threats and vulnerabilities of their CII; Amendment 43 # Ivailo KALFIN Motion for a resolution Paragraph 9 9. Welcomes the various stakeholder consultations on internet security and CIIP initiated by the Commission, ~~including~~as the European Public-Private Partnership for Resilience ~~and the 2011 Digital Assembly;~~; Acknowledging the already significant involvement and commitment of ICT vendors in such efforts, encourages the Commission to make further efforts to encourage academia and ICT users' associations to play a more active role, and to foster constructive, multi-stakeholder dialogue on cyber- security issues; Supports of a further development of the Digital Assembly as a framework for CIIP governance; Amendment 44 # Ivailo KALFIN Motion for a resolution Paragraph 10 10. Welcomes the work accomplished so far by the European Forum of Member States in ~~laying down~~terms of setting sector- specific criteria ~~for~~to identify~~ing~~ European critical EU infrastructure,s with a focus on fixed and mobile communications, a~~nd in~~s well as discussing the EU principles and guidelines for the resilience and the stability ~~of the i~~in Internet~~, and~~; looks forward to continuing ~~consensus- building among the Member States~~to build consensus among the Member States, and in this context encourages the Forum to complement the current approach focused on physical assets with efforts to also encompass logical infrastructure assets which, as virtualization and cloud technologies develop, will become increasingly relevant to the effectiveness of CIIP; Amendment 45 # Jürgen CREUTZMANN Motion for a resolution Paragraph 10 a (new) 10a. Suggests that the Commission launches a public pan-European education initiative, focused at educating and raising awareness of both private and business end-users for potential threats on the Internet and fixed and mobile ICT devices at every level of the utility chain and in promoting safer individual online behaviours; Reminds in this regard of the risks associated with outdated IT equipment and software. Recommends providing incentives to companies for regular software updates and hardware upgrades to ensure a high level of IT security; Amendment 46 # Silvia-Adriana ŢICĂU Motion for a resolution Paragraph 10 a (new) 10a. Welcomes the adoption of the ‘Open Data’ package and considers that this presents new opportunities both for Member State governments and for the private sector, and especially for SMEs; draws attention to the fact that the ‘Open Data’ package is a catalyst and an opportunity both for the development of ‘cloud computing’, and also for the reuse of data generated by the public sector (with the exception of personal data); Amendment 47 # Ivailo KALFIN Motion for a resolution Paragraph 10 a (new) 10a. Calls on Member States, with the support from the Commission, to strengthen the training and education programs on information security, targeted to national law enforcement and judicial authorities and the relevant EU agencies; Amendment 48 # Ivailo KALFIN Motion for a resolution Paragraph 10 b (new) 10b. Supports the creation of a European curriculum for academic experts in the field of information security, as it would have a positive impact on the expertise and preparedness of the EU with regards to the constantly evolving cyberspace and its threats; Amendment 49 # Ivailo KALFIN Motion for a resolution Paragraph 10 c (new) 10c. Suggests that the Commission launches a public pan-European education initiative, focused at educating and raising awareness of end-users on potential threats on the Internet and fixed and mobile ICT devices at every level of the utility chain and in promoting safer individual online behaviours; Amendment 50 # Lambert van NISTELROOIJ Motion for a resolution Paragraph 11 11. Calls on the Commission to propose, by the end of 2012, a comprehensive internet security strategy for the Union, based on clear terminology; takes the view that the internet security strategy should aim at creating a cyberspace – supported by a secure and resilient infrastructure – which is conducive to innovation, the free flow of information and prosperity and which protects privacy and other civil liberties; maintains that the strategy should detail the principles, goals, methods, instruments and policies (both internal and external) necessary in order to streamline national and EU efforts, and to establish minimum resilience standards among the, Member States, to ensure a safe, continuous, robust and resilient service, whether in connection with critical infrastructure or general internet use; Amendment 51 # Krišjānis KARIŅŠ Motion for a resolution Paragraph 11 11. Calls on the Commission to propose, by the end of 2012, a comprehensive internet security strategy for the Union, based on clear terminology; takes the view that the internet security strategy should aim at creating a cyberspace – supported by a secure and resilient infrastructure and open standards – which is conducive to innovation, the free flow of information and prosperity and which protects privacy and other civil liberties; maintains that the strategy should detail the principles, goals, methods, instruments and policies (both internal and external) necessary in order to streamline national and EU efforts to ensure a safe, continuous, robust and resilient service, whether in connection with critical infrastructure or general internet use; Amendment 52 # Ivailo KALFIN Motion for a resolution Paragraph 11 11. Calls on the Commission to propose, by the end of 2012, a comprehensive internet security strategy for the Union, based on clear terminology; takes the view that the internet security strategy should aim at creating a cyberspace – supported by a secure and resilient infrastructure – which is conducive to innovation, and prosperity through the free flow of information ~~and prosperity and which~~while ensuring robust protectsion of privacy and other civil liberties; maintains that the strategy should detail the principles, goals, methods, instruments and policies (both internal and external) necessary in order to streamline national and EU efforts to ensure a safe, continuous, robust and resilient service, whether in connection with critical infrastructure or general internet use; Amendment 53 # Ivailo KALFIN Motion for a resolution Paragraph 11 a (new) 11a. Urges the Commission to propose a robust mechanism to coordinate the implementation and regular update of the Internet security strategy. This mechanism should be supported by sufficient administrative, expert and financial resources and have the competence to facilitate the elaboration of EU positions in relations with both internal and international stakeholders on Internet security related issues; Amendment 54 # Jürgen CREUTZMANN Motion for a resolution Paragraph 12 12. Calls on the Commission to pr~~opose an EU framework for the notification of~~esent recommendations for security/data breaches notification in critical sectors (information and communication technologies, financial services, energy, transport, water and food supply), ~~with a view to informing the~~to notify relevant Member States a~~nd user~~uthorities of cyber- incidents, -attacks ~~and -~~or disruptions; Amendment 55 # Lambert van NISTELROOIJ Motion for a resolution Paragraph 12 12. Calls on the Commission to propose an EU framework for the notification of security breaches in critical sectors ~~(information and communication technologies,~~, notably the ICT sector and the financial services, but also the energy, transport, water and food supply) sectors, with a view to informing the Member States and users of cyber-incidents, -attacks and - disruptions; Amendment 56 # Silvia-Adriana ŢICĂU Motion for a resolution Paragraph 12 a (new) 12a. Welcomes the establishment of the European Cloud Computing Partnership as well as the Commission’s commitment to develop European Cloud Computing Strategy by the end of July 2012; requests that the Commission ensure that this Strategy is flanked by an action plan to guarantee that the EU will become pro- active in cloud computing; believes that this action plan should focus on: respect for fundamental human rights, the right to privacy and the protection of personal data; a public-private partnership for the development of the EU ‘Cloud’; standards, certification, data protection, interoperability and legal certainty; data ownership, responsibility for data security and governance; guidelines and standard models for Service Level agreements and End User agreements; the necessary financial resources; Amendment 57 # Lambert van NISTELROOIJ Motion for a resolution Paragraph 12 a (new) 12a. Urges the Commission to improve the availability of statically representative data concerning the costs of cyber attacks in the EU, the Member States and industry (in particular the financial services and ICT sector) by enhancing the data gathering capabilities of the envisaged European Cybercrime Centre, planned to be set up by 2013, the CERTs and other initiatives of the Commission such as the European Information Sharing and Alert System, so to ensure systematic reporting and sharing of data concerning cyber-attacks and other forms of cybercrime inflicting European industry and Member States; and so to, strengthen law enforcement; Amendment 58 # Amelia ANDERSDOTTER Motion for a resolution Paragraph 13 13. Points out that the primary driving force behind the development and use of technologies designed to increase internet security is the ICT industry; recalls that EU policies need to include the necessary incentives in order to exploit the potential of business and public-private partnerships to the full, recommends the investigation of further incentives for the industry to develop more robust operator security plans according to 2008/114/EC; Amendment 59 # Lambert van NISTELROOIJ Motion for a resolution Paragraph 13 13. Points out that the primary driving force behind the development and use of technologies designed to increase internet security is the ICT industry; recalls that EU policies ~~need to~~must avoid impeding the growth of the European internet economy and include the necessary incentives in order to exploit the potential of business and public-private partnerships to the full; Amendment 60 # Ivailo KALFIN Motion for a resolution Paragraph 13 a (new) 13a. Calls on the Commission to present a legislative proposal for further criminalising cyber attacks (i.e. spear- phishing, on-line fraud, etc.); Amendment 61 # Ivailo KALFIN Motion for a resolution Paragraph 13 a (new) – Title 3 (new) III. INTERNATIONAL COOPERATION Amendment 62 # Ioan ENCIU Motion for a resolution Paragraph 14 14. Recalls that international cooperation is the core instrument for introducing effective cyber-security measures; recognises that, at present, the EU is not actively involved on an ongoing basis in international cooperation processes and dialogues relating to cyber-security; calls on the Commission and the European External Action Service (EEAS) to start a constructive dialogue with all like-minded countries with a view to developing a common understanding and policies with the aim of increasing the resilience of the internet and of critical infrastructure; maintains that, at the same time, the EU should – on a permanent basis – include internet security issues in the scope of its external relations, inter alia when designing various financing instruments or when committing to international agreements which involve the exchange and storage of sensitive data; Amendment 63 # Ivailo KALFIN Motion for a resolution Paragraph 14 14. Re~~call~~minds that international cooperation is the core instrument for introducing effective cyber-security measures; recognises that, at present, the EU is not actively involved on an ongoing basis in international cooperation processes and dialogues relating to cyber-security; calls on the Commission and the European External Action Service (EEAS) to start a constructive dialogue with all like-minded countries with a view to developing a common understanding and policies with the aim of increasing the resilience of the internet and of critical infrastructure; maintains that, at the same time, the EU should – on a permanent basis – include internet security issues in the scope of its external relations, inter alia when designing various financing instruments; Amendment 64 # Ivailo KALFIN Motion for a resolution Paragraph 14 a (new) 14a. Takes note of the positive achievements of the 2001 Council of Europe Budapest Convention on cybercrime. At the same time, while encouraging more countries to sign and ratify the Convention, the EEAS should also build bilateral and multilateral agreements on Internet security and resilience with like-minded international partners; Amendment 65 # Ivailo KALFIN Motion for a resolution Paragraph 15 15. Welcomes the creation, at the November 2010 EU-US Summit, of the EU-US Working Group on Cyber-security and Cyber-crime, and supports its efforts to develop the necessary set of standards in order to foster international cooperation on digital security; Welcomes the joint elaboration, by the Commission and the US government, under the umbrella of the EU-U.S. Working Group, of a common program and a roadmap towards joint/synchronized trans-continental cyber-exercises in 2012/ 2013; Amendment 66 # Ivailo KALFIN Motion for a resolution Paragraph 15 15. Welcomes the creation, at the November 2010 EU-US Summit, of the EU-US Working Group on Cyber-security and Cyber-crime, and supports its efforts to ~~develop the necessary set of standards in order to foster international cooperation on digital security~~including the internet security issues in the transatlantic policy dialogue; Amendment 67 # Ivailo KALFIN Motion for a resolution Paragraph 17 a (new) 17a. Encourages the Commission and ENISA to participate in the main stakeholder dialogues to define technical and legal norms in cyberspace at an international level. source: PE-483.516

Amendments

Dossier

2011/2284(INI) Critical information infrastructure protection. Achievements and next steps: towards global cyber-security

2012/02/29 LIBE 23 amendments...

Amendment 1 #

Ioan ENCIU

Draft opinion
Paragraph 1

1. Considers that the protection of critical information infrastructure requires an interdisciplinary approach that needs to include the important aspects of civil liberties, justice and home affairs such as internal security, personal data protection and the right to confidentiality and a private life;

Amendment 2 #

Kinga GÖNCZ

Draft opinion
Paragraph 1

1. Considers that the protection of critical information infrastructure requires an interdisciplinary approach that needs to include the important aspects of civil liberties, justice and home affairs, namely enhancing security while respecting fundamental rights;

Amendment 3 #

Rolandas PAKSAS

Draft opinion
Paragraph 1 a (new)

1a. Stresses that the EU should provide strong leadership and unify all stakeholders so as to take effective action to protect Europe from possible threats to its critical information infrastructures;

Amendment 4 #

Ioan ENCIU

Draft opinion
Paragraph 3

3. Urges that the identification of European Critical Infrastructure be completed and continuously updated under the supervision of the Commission, in accordance with Directive 2008/114; stresses also the need to create the Critical Infrastructure Warning Information Network (CIWIN) at a European level as soon as possible;

Amendment 5 #

Monika HOHLMEIER

Draft opinion
Paragraph 3 a (new)

3 a. insists that in view of the strong dependency of public institutions, businesses and private households on Information and Communication Technologies (ICT) the Council Directive 2008/114/EC (on the identification and designation of European critical infrastructures and the assessment of the need to improve their protection) should be reviewed in order to also recognise ICT as a critical sector;

Amendment 6 #

Rolandas PAKSAS

Draft opinion
Paragraph 4

4. UCalls on the Member States to develop a national strategy and ensure a solid policy-making and regulatory environment, comprehensive risk management procedures and appropriate preparatory measures and mechanisms; urges the Member States that have not founded their national CERT (Computer Emergency Response Team) to found it in due course, with the assistance of ENISA, if needed;

Amendment 7 #

Kinga GÖNCZ

Draft opinion
Paragraph 5

5. Takes the view that any large-scale database handling sensitive personal data, such as those of the EU, Member State governments and financial and healthcare institutions, should be considered to be part of the critical information infrastructure and the protection of such data should be ensured according to the highest possible standards;

Amendment 8 #

Alexander ALVARO

Draft opinion
Paragraph 5 a (new)

5 a. Calls on the Commission and the Member States to take the necessary measures in order to protect critical infrastructure from cyber attacks and provide for means to hermetically cut off access to a critical infrastructure in case a direct cyber attack severely threatens its proper functioning;

Amendment 9 #

Ioan ENCIU

Draft opinion
Paragraph 6 a (new)

6a. Considers that ENISA can fulfil a key role at a European level concerning the protection of critical information infrastructures by providing technical expertise to Member States and European Union institutions and bodies, as well as reports and analyses concerning information system security at European and global level;

Amendment 10 #

Ioan ENCIU

Draft opinion
Paragraph 7

7. Believes that international cooperation beyond the EU is indispensable, as the nature of cyber-threats is global, requiring global responses; stresses also that any international agreement involving the exchange of sensitive data should take into consideration the security of data transfer and storage;

Amendment 11 #

Valdemar TOMAŠEVSKI

Draft opinion
Paragraph 7

7. believes that international cooperation beyond the EU is indispensable, as the nature of cyber-threats is global, requiring global responses that comply with the provisions of international law;

Amendment 12 #

Monika HOHLMEIER

Draft opinion
Paragraph 7 a (new)

7 a. emphasises that the upcoming "Internet Security Strategy" by the Commission should take the work on CIIP as a central point of reference and aim for a holistic and systematic approach towards cyber security by including both proactive measures, such as the introduction of minimum standards for security measures or the teaching of individual users, businesses and public institutions, and reactive measures, such as criminal, civil and administrative sanctions;

Amendment 13 #

Ioan ENCIU

Draft opinion
Paragraph 8

8. Believes that coo~~rdin~~peration ~~within the EU~~ should be strengthened and enhanced ~~first and foremost between civilian and military actors~~between the judicial and other competent authorities in preventing, combating and penalising attacks against information systems, including the police and other law enforcement authorities from the Member States, as well as specialised agencies at a European level, such as Eurojust, Europol, ENISA;

Amendment 14 #

Rui TAVARES

Draft opinion
Paragraph 8

8. Believes that coordination within the EU should be strengthened and enhanced ~~first and foremost between civilian and military actors~~between all actors involved;

Amendment 15 #

Kinga GÖNCZ

Draft opinion
Paragraph 9

Amendment 16 #

Rolandas PAKSAS

Draft opinion
Paragraph 9

9. Emphasises the importance of strong cooperation between the public and the private sectors, as the different strengths of the sectors should contribute, through mutual complementation, to the efforts made to protect the infrastructure and thus the lives of European citizens; calls on the Commission to establish the European Public-Private Partnership for Resilience, which would be integrated with the work of the European Network and Information Security Agency (ENISA) and the European Government CERTs Group;

Amendment 17 #

Roberta ANGELILLI

Draft opinion
Paragraph 10 a (new)

10 a. Considers that the efforts in the protection of Critical Information Infrastructures will not only enhance overall security of citizens but will improve also the citizens' perception of security and their trust in measures adopted by Government to protect them;

Amendment 18 #

Roberta ANGELILLI

Draft opinion
Paragraph 10 b (new)

10 b. Emphasises the importance of establishing and ensuring a durable integration of European Research to maintain and strengthen the European excellence in the area of Critical Information Infrastructure Protection;

Amendment 19 #

Roberta ANGELILLI

Draft opinion
Paragraph 10 c (new)

10 c. Emphasises the importance of an active research roadmap in the area of cyber-security;

Amendment 20 #

Roberta ANGELILLI

Draft opinion
Paragraph 10 d (new)

10 d. Promotes cyber-security education (PhD student internships, university courses, workshops, training for students, etc...) and specialized training exercises in Critical Information Infrastructure Protection;

Amendment 21 #

Roberta ANGELILLI

Draft opinion
Paragraph 10 e (new)

10 e. Enhances a close relationship and interaction between National Private Sector and ENISA to interface the National/Governmental CERTs with EISAS evolution;

Amendment 22 #

Roberta ANGELILLI

Draft opinion
Paragraph 10 f (new)

10 f. Emphasizes the importance of a common European Cyber Security Strategy and articulate a timeline for its definition in terms of actions and needed resources;

Amendment 23 #

Roberta ANGELILLI

Draft opinion
Paragraph 10 g (new)

10 g. Underlines the importance about a structured dialogue between EU - US joint transcontinental CIIP's main players and legislators for common understanding, interpretation and position on legal and governance frameworks.

source: PE-483.744

2012/06/03 ITRE 67 amendments...

Amendment 1 #

activities/11/docs	added	url http://www.europarl.europa.eu/sides/getDoc.do?type=TA&language=EN&reference=P7-TA-2012-237 type Decision by Parliament, 1st reading/single reading title T7-0237/2012
activities/11/type	changed	Old Vote scheduled New Text adopted by Parliament, single reading
procedure/stage_reached	changed	Old Awaiting Parliament 1st reading / single reading / budget 1st stage New Procedure completed

activities/7/committees	added	body EP responsible False committee_full Foreign Affairs committee AFET body EP shadows group EPP name VAN NISTELROOIJ Lambert group ALDE name CREUTZMANN Jürgen group ECR name TOŠENOVSKÝ Evžen group EFD name TZAVELA Niki responsible True committee ITRE date 2011-06-07 committee_full Industry, Research and Energy rapporteur group S&D name KALFIN Ivailo body EP responsible False committee LIBE date 2011-11-23 committee_full Civil Liberties, Justice and Home Affairs rapporteur group EPP name HANKISS Ágnes
activities/7/type	changed	Old Vote scheduled in committee, 1st reading/single reading New Vote in committee, 1st reading/single reading

activities/1/docs/0/url	added	http://eur-lex.europa.eu/smartapi/cgi/sga_doc?smartapi!celexplus!prod!DocNumber&lg=EN&type_doc=COMfinal&an_doc=2011&nu_doc=163
activities/4/docs/0/url	added	http://www.europarl.europa.eu/sides/getDoc.do?type=COMPARL&mode=XML&language=EN&reference=PE474.017
activities/7/type	changed	Old EP 1R Committee New Vote scheduled in committee, 1st reading/single reading

activities/1	deleted	date 2011-03-31 docs text PURPOSE: to take stock of the results achieved since the adoption of the Critical Information Infrastructure Protection (CIIP) action plan and describe the next steps planned for each action. BACKGROUND: the Commission adopted on 30 March 2009 a communication on Critical Information Infrastructure Protection (the ‘CIIP action plan’) to strengthen the security and resilience of vital Information and Communication Technology (ICT) infrastructures. The aim was to stimulate and support the development of a high level of preparedness, security and resilience capabilities both at national and European level. The action plan is built on five pillars: preparedness and prevention, detection and response, mitigation and recovery, international cooperation and criteria for European Critical Infrastructures in the field of ICT. At the same time the Digital Agenda for Europe, adopted in May 2010, emphasises the need for all stakeholders to join their forces in a holistic effort to ensure the security and resilience of ICT infrastructures, by focusing on prevention, preparedness and awareness, as well as developing effective and coordinated mechanisms to respond to new and increasingly sophisticated forms of cyber-attacks and cyber-crime. Complementing this, the Commission tabled a proposal for a new mandate to strengthen and modernise the European Network and Information Security Agency (ENISA) in order to boost trust and network security. This Communication takes stock of the results achieved since the adoption of the CIIP action plan in 2009. It describes the next steps planned for each action at both European and international level. It also focuses on the global dimension of the challenges and the importance of boosting cooperation among Member States and the private sector at national, European and international level, in order to address global interdependencies. CONTENT: the Communication begins by identifying the potential threats which may disrupt access to information networks. In order to gain a more comprehensive understanding of these various threats, it can be useful to regroup them along the following categories: – exploitation purposes, such as "advanced persistent threats" for economic and political espionage purposes (e.g. GhostNet), identity theft, the recent attacks against the Emissions Trading System etc; – disruption purposes, such as Distributed Denial of Service attacks or spamming generated via botnets (e.g. the Conficker network of 7 million machines) ; – destruction purposes, which is a scenario that has not yet materialised but, cannot be ruled out for the years to come. In order to counter these threats, the Commission highlights some of the actions it has taken: 1) Preparedness and prevention: · the establishment of the European Forum of Member States (EFMS) made significant progress in fostering discussion and exchanges related to security and resilience of ICT infrastructures; · the European Public-Private Partnership for Resilience (EP3R) aims at fostering the cooperation between the public and the private sectors on strategic EU security and resilience policy issues; · the creation of a network of well-functioning National/Governmental CERTs in all Member States by 2012, which will be the backbone of the European Information Sharing and Alert System (EISAS) for citizens and SMEs. 2) Detection and response: ENISA devised a high-level roadmap for the development of a European Information Sharing and Alert System (EISAS) by 2013. 3) Mitigation and recovery: so far only 12 Member States that have organised exercises for large-scale network security incident response and disaster recovery. The first pan-European exercise on large-scale network security incidents (Cyber Europe 2010) took place on 4 November 2010 with the involvement of all Member States, plus Switzerland, Norway and Iceland. Future pan-European cyber exercises would undoubtedly benefit from a common framework. 4) International cooperation: the Commission will discuss and promote the principles with relevant stakeholders, in particular the private sector (via EP3R), bilaterally with key international partners, in particular the US, as well as multilaterally. It will do so, within its competences, in fora such as G8, OECD, NATO, etc. 5) Criteria for European Critical Infrastructures in the ICT sector: the technical discussion in EFMS led to a first draft of the ICT sector-specific criteria for identifying European Critical Infrastructures, with a focus on fixed and mobile communications and the Internet. The technical discussion will continue and benefit from the consultations on the draft criteria, at national and European (via EP3R) level, with the private sector. The Commission will also discuss with Member States the ICT sector- specific elements to be considered for the review of the Directive on the identification and designation of European critical infrastructures and the assessment of the need to improve their protection in 2012. Next steps: in the face of global challenges, the Commission will: · promote principles for the resilience and stability of the Internet: international principles for the resilience and stability of the Internet should be developed with other countries, with international organisations and, where appropriate, with global private- sector organisations – by using existing fora and processes, such as those related to Internet Governance. These principles should serve as a tool for all stakeholders to frame their activities, relating to the stability and resilience of the Internet; · build strategic international partnerships: strategic partnerships should be built on ongoing efforts in critical areas, like cyber-incident management, including exercises and cooperation among CERTs. The engagement of the private sector, which operates on a global scale, is of paramount importance. The EU-U.S. Working Group on Cyber-security and Cyber-crime is an important step in this direction. The Working Group will focus on cyber incident management, public-private partnerships, awareness raising and cyber-crime. On the European side, key factors for success would be good coordination between all EU institutions, relevant agencies (in particular ENISA and Europol) and Member States. · develop trust in the cloud: it is essential to strengthen discussions on the best governance strategies for emerging technologies with a global impact, such as cloud computing. Member States are called upon to: · enhance EU preparedness by establishing a network of well functioning National/Governmental CERTs by 2012. This activity will also advance the development of a European Information Sharing and Alert System (EISAS) to the wider public by 2013; · establish a European cyber-incident contingency plan by 2012 and regular pan-European cyber exercises. Future pan-European cyber exercises should be based on a European cyber incident contingency plan that builds upon and interlinks with national contingency plans. Such a plan should provide the baseline mechanisms and procedure for communications between Member States and, last but not least, support the scoping and organisation of future pan-European exercises. ENISA will work with Member States on the development of such a European cyber incident contingency plan by 2012; · ensure European coordinated efforts in international fora and discussions on enhancing security and resilience of Internet. Member States should cooperate together and with the Commission on promoting the development of an approach based on principles or norms to the issue of the global stability and resilience of the Internet. It should be noted than an Annex to the Communication gives a detailed overview of achievements of the CIIP action plan as well as the next steps. title COM(2011)0163 type Non-legislative basic document published celexid CELEX:52011DC0163:EN type Non-legislative basic document body EC commission DG url http://ec.europa.eu/dgs/information_society/index_en.htm title Information Society and Media Commissioner KROES Neelie
activities/1/body	changed	Old EP New EC
activities/1/commission	added	DG url http://ec.europa.eu/dgs/information_society/index_en.htm title Information Society and Media Commissioner KROES Neelie
activities/1/date	changed	Old 2012-05-21 New 2011-03-31
activities/1/docs	added	url http://eur-lex.europa.eu/smartapi/cgi/sga_doc?smartapi!celexplus!prod!DocNumber&lg=EN&type_doc=COMfinal&an_doc=2011&nu_doc=163 text PURPOSE: to take stock of the results achieved since the adoption of the Critical Information Infrastructure Protection (CIIP) action plan and describe the next steps planned for each action. BACKGROUND: the Commission adopted on 30 March 2009 a communication on Critical Information Infrastructure Protection (the ‘CIIP action plan’) to strengthen the security and resilience of vital Information and Communication Technology (ICT) infrastructures. The aim was to stimulate and support the development of a high level of preparedness, security and resilience capabilities both at national and European level. The action plan is built on five pillars: preparedness and prevention, detection and response, mitigation and recovery, international cooperation and criteria for European Critical Infrastructures in the field of ICT. At the same time the Digital Agenda for Europe, adopted in May 2010, emphasises the need for all stakeholders to join their forces in a holistic effort to ensure the security and resilience of ICT infrastructures, by focusing on prevention, preparedness and awareness, as well as developing effective and coordinated mechanisms to respond to new and increasingly sophisticated forms of cyber-attacks and cyber-crime. Complementing this, the Commission tabled a proposal for a new mandate to strengthen and modernise the European Network and Information Security Agency (ENISA) in order to boost trust and network security. This Communication takes stock of the results achieved since the adoption of the CIIP action plan in 2009. It describes the next steps planned for each action at both European and international level. It also focuses on the global dimension of the challenges and the importance of boosting cooperation among Member States and the private sector at national, European and international level, in order to address global interdependencies. CONTENT: the Communication begins by identifying the potential threats which may disrupt access to information networks. In order to gain a more comprehensive understanding of these various threats, it can be useful to regroup them along the following categories: – exploitation purposes, such as "advanced persistent threats" for economic and political espionage purposes (e.g. GhostNet), identity theft, the recent attacks against the Emissions Trading System etc; – disruption purposes, such as Distributed Denial of Service attacks or spamming generated via botnets (e.g. the Conficker network of 7 million machines) ; – destruction purposes, which is a scenario that has not yet materialised but, cannot be ruled out for the years to come. In order to counter these threats, the Commission highlights some of the actions it has taken: 1) Preparedness and prevention: · the establishment of the European Forum of Member States (EFMS) made significant progress in fostering discussion and exchanges related to security and resilience of ICT infrastructures; · the European Public-Private Partnership for Resilience (EP3R) aims at fostering the cooperation between the public and the private sectors on strategic EU security and resilience policy issues; · the creation of a network of well-functioning National/Governmental CERTs in all Member States by 2012, which will be the backbone of the European Information Sharing and Alert System (EISAS) for citizens and SMEs. 2) Detection and response: ENISA devised a high-level roadmap for the development of a European Information Sharing and Alert System (EISAS) by 2013. 3) Mitigation and recovery: so far only 12 Member States that have organised exercises for large-scale network security incident response and disaster recovery. The first pan-European exercise on large-scale network security incidents (Cyber Europe 2010) took place on 4 November 2010 with the involvement of all Member States, plus Switzerland, Norway and Iceland. Future pan-European cyber exercises would undoubtedly benefit from a common framework. 4) International cooperation: the Commission will discuss and promote the principles with relevant stakeholders, in particular the private sector (via EP3R), bilaterally with key international partners, in particular the US, as well as multilaterally. It will do so, within its competences, in fora such as G8, OECD, NATO, etc. 5) Criteria for European Critical Infrastructures in the ICT sector: the technical discussion in EFMS led to a first draft of the ICT sector-specific criteria for identifying European Critical Infrastructures, with a focus on fixed and mobile communications and the Internet. The technical discussion will continue and benefit from the consultations on the draft criteria, at national and European (via EP3R) level, with the private sector. The Commission will also discuss with Member States the ICT sector- specific elements to be considered for the review of the Directive on the identification and designation of European critical infrastructures and the assessment of the need to improve their protection in 2012. Next steps: in the face of global challenges, the Commission will: · promote principles for the resilience and stability of the Internet: international principles for the resilience and stability of the Internet should be developed with other countries, with international organisations and, where appropriate, with global private- sector organisations – by using existing fora and processes, such as those related to Internet Governance. These principles should serve as a tool for all stakeholders to frame their activities, relating to the stability and resilience of the Internet; · build strategic international partnerships: strategic partnerships should be built on ongoing efforts in critical areas, like cyber-incident management, including exercises and cooperation among CERTs. The engagement of the private sector, which operates on a global scale, is of paramount importance. The EU-U.S. Working Group on Cyber-security and Cyber-crime is an important step in this direction. The Working Group will focus on cyber incident management, public-private partnerships, awareness raising and cyber-crime. On the European side, key factors for success would be good coordination between all EU institutions, relevant agencies (in particular ENISA and Europol) and Member States. · develop trust in the cloud: it is essential to strengthen discussions on the best governance strategies for emerging technologies with a global impact, such as cloud computing. Member States are called upon to: · enhance EU preparedness by establishing a network of well functioning National/Governmental CERTs by 2012. This activity will also advance the development of a European Information Sharing and Alert System (EISAS) to the wider public by 2013; · establish a European cyber-incident contingency plan by 2012 and regular pan-European cyber exercises. Future pan-European cyber exercises should be based on a European cyber incident contingency plan that builds upon and interlinks with national contingency plans. Such a plan should provide the baseline mechanisms and procedure for communications between Member States and, last but not least, support the scoping and organisation of future pan-European exercises. ENISA will work with Member States on the development of such a European cyber incident contingency plan by 2012; · ensure European coordinated efforts in international fora and discussions on enhancing security and resilience of Internet. Member States should cooperate together and with the Commission on promoting the development of an approach based on principles or norms to the issue of the global stability and resilience of the Internet. It should be noted than an Annex to the Communication gives a detailed overview of achievements of the CIIP action plan as well as the next steps. celexid CELEX:52011DC0163:EN type Non-legislative basic document published title COM(2011)0163
activities/1/type	changed	Old EP 1R Plenary New Non-legislative basic document
activities/9	deleted	body EC date 2012-05-21 type Prev DG PRES commission DG url http://ec.europa.eu/dgs/information_society/index_en.htm title Information Society and Media Commissioner KROES Neelie

activities/1	deleted	date 2011-03-31 docs url http://eur-lex.europa.eu/smartapi/cgi/sga_doc?smartapi!celexplus!prod!DocNumber&lg=EN&type_doc=COMfinal&an_doc=2011&nu_doc=163 text PURPOSE: to take stock of the results achieved since the adoption of the Critical Information Infrastructure Protection (CIIP) action plan and describe the next steps planned for each action. BACKGROUND: the Commission adopted on 30 March 2009 a communication on Critical Information Infrastructure Protection (the ‘CIIP action plan’) to strengthen the security and resilience of vital Information and Communication Technology (ICT) infrastructures. The aim was to stimulate and support the development of a high level of preparedness, security and resilience capabilities both at national and European level. The action plan is built on five pillars: preparedness and prevention, detection and response, mitigation and recovery, international cooperation and criteria for European Critical Infrastructures in the field of ICT. At the same time the Digital Agenda for Europe, adopted in May 2010, emphasises the need for all stakeholders to join their forces in a holistic effort to ensure the security and resilience of ICT infrastructures, by focusing on prevention, preparedness and awareness, as well as developing effective and coordinated mechanisms to respond to new and increasingly sophisticated forms of cyber-attacks and cyber-crime. Complementing this, the Commission tabled a proposal for a new mandate to strengthen and modernise the European Network and Information Security Agency (ENISA) in order to boost trust and network security. This Communication takes stock of the results achieved since the adoption of the CIIP action plan in 2009. It describes the next steps planned for each action at both European and international level. It also focuses on the global dimension of the challenges and the importance of boosting cooperation among Member States and the private sector at national, European and international level, in order to address global interdependencies. CONTENT: the Communication begins by identifying the potential threats which may disrupt access to information networks. In order to gain a more comprehensive understanding of these various threats, it can be useful to regroup them along the following categories: – exploitation purposes, such as "advanced persistent threats" for economic and political espionage purposes (e.g. GhostNet), identity theft, the recent attacks against the Emissions Trading System etc; – disruption purposes, such as Distributed Denial of Service attacks or spamming generated via botnets (e.g. the Conficker network of 7 million machines) ; – destruction purposes, which is a scenario that has not yet materialised but, cannot be ruled out for the years to come. In order to counter these threats, the Commission highlights some of the actions it has taken: 1) Preparedness and prevention: · the establishment of the European Forum of Member States (EFMS) made significant progress in fostering discussion and exchanges related to security and resilience of ICT infrastructures; · the European Public-Private Partnership for Resilience (EP3R) aims at fostering the cooperation between the public and the private sectors on strategic EU security and resilience policy issues; · the creation of a network of well-functioning National/Governmental CERTs in all Member States by 2012, which will be the backbone of the European Information Sharing and Alert System (EISAS) for citizens and SMEs. 2) Detection and response: ENISA devised a high-level roadmap for the development of a European Information Sharing and Alert System (EISAS) by 2013. 3) Mitigation and recovery: so far only 12 Member States that have organised exercises for large-scale network security incident response and disaster recovery. The first pan-European exercise on large-scale network security incidents (Cyber Europe 2010) took place on 4 November 2010 with the involvement of all Member States, plus Switzerland, Norway and Iceland. Future pan-European cyber exercises would undoubtedly benefit from a common framework. 4) International cooperation: the Commission will discuss and promote the principles with relevant stakeholders, in particular the private sector (via EP3R), bilaterally with key international partners, in particular the US, as well as multilaterally. It will do so, within its competences, in fora such as G8, OECD, NATO, etc. 5) Criteria for European Critical Infrastructures in the ICT sector: the technical discussion in EFMS led to a first draft of the ICT sector-specific criteria for identifying European Critical Infrastructures, with a focus on fixed and mobile communications and the Internet. The technical discussion will continue and benefit from the consultations on the draft criteria, at national and European (via EP3R) level, with the private sector. The Commission will also discuss with Member States the ICT sector- specific elements to be considered for the review of the Directive on the identification and designation of European critical infrastructures and the assessment of the need to improve their protection in 2012. Next steps: in the face of global challenges, the Commission will: · promote principles for the resilience and stability of the Internet: international principles for the resilience and stability of the Internet should be developed with other countries, with international organisations and, where appropriate, with global private- sector organisations – by using existing fora and processes, such as those related to Internet Governance. These principles should serve as a tool for all stakeholders to frame their activities, relating to the stability and resilience of the Internet; · build strategic international partnerships: strategic partnerships should be built on ongoing efforts in critical areas, like cyber-incident management, including exercises and cooperation among CERTs. The engagement of the private sector, which operates on a global scale, is of paramount importance. The EU-U.S. Working Group on Cyber-security and Cyber-crime is an important step in this direction. The Working Group will focus on cyber incident management, public-private partnerships, awareness raising and cyber-crime. On the European side, key factors for success would be good coordination between all EU institutions, relevant agencies (in particular ENISA and Europol) and Member States. · develop trust in the cloud: it is essential to strengthen discussions on the best governance strategies for emerging technologies with a global impact, such as cloud computing. Member States are called upon to: · enhance EU preparedness by establishing a network of well functioning National/Governmental CERTs by 2012. This activity will also advance the development of a European Information Sharing and Alert System (EISAS) to the wider public by 2013; · establish a European cyber-incident contingency plan by 2012 and regular pan-European cyber exercises. Future pan-European cyber exercises should be based on a European cyber incident contingency plan that builds upon and interlinks with national contingency plans. Such a plan should provide the baseline mechanisms and procedure for communications between Member States and, last but not least, support the scoping and organisation of future pan-European exercises. ENISA will work with Member States on the development of such a European cyber incident contingency plan by 2012; · ensure European coordinated efforts in international fora and discussions on enhancing security and resilience of Internet. Member States should cooperate together and with the Commission on promoting the development of an approach based on principles or norms to the issue of the global stability and resilience of the Internet. It should be noted than an Annex to the Communication gives a detailed overview of achievements of the CIIP action plan as well as the next steps. celexid CELEX:52011DC0163:EN type Non-legislative basic document published title COM(2011)0163 body EC commission DG url http://ec.europa.eu/dgs/information_society/index_en.htm title Information Society and Media Commissioner KROES Neelie type Non-legislative basic document
activities/1/body	changed	Old EP New EC
activities/1/commission	added	DG url http://ec.europa.eu/dgs/information_society/index_en.htm title Information Society and Media Commissioner KROES Neelie
activities/1/date	changed	Old 2012-02-07 New 2011-03-31
activities/1/docs/0/celexid	added	CELEX:52011DC0163:EN
activities/1/docs/0/text	added	PURPOSE: to take stock of the results achieved since the adoption of the Critical Information Infrastructure Protection (CIIP) action plan and describe the next steps planned for each action. BACKGROUND: the Commission adopted on 30 March 2009 a communication on Critical Information Infrastructure Protection (the ‘CIIP action plan’) to strengthen the security and resilience of vital Information and Communication Technology (ICT) infrastructures. The aim was to stimulate and support the development of a high level of preparedness, security and resilience capabilities both at national and European level. The action plan is built on five pillars: preparedness and prevention, detection and response, mitigation and recovery, international cooperation and criteria for European Critical Infrastructures in the field of ICT. At the same time the Digital Agenda for Europe, adopted in May 2010, emphasises the need for all stakeholders to join their forces in a holistic effort to ensure the security and resilience of ICT infrastructures, by focusing on prevention, preparedness and awareness, as well as developing effective and coordinated mechanisms to respond to new and increasingly sophisticated forms of cyber-attacks and cyber-crime. Complementing this, the Commission tabled a proposal for a new mandate to strengthen and modernise the European Network and Information Security Agency (ENISA) in order to boost trust and network security. This Communication takes stock of the results achieved since the adoption of the CIIP action plan in 2009. It describes the next steps planned for each action at both European and international level. It also focuses on the global dimension of the challenges and the importance of boosting cooperation among Member States and the private sector at national, European and international level, in order to address global interdependencies. CONTENT: the Communication begins by identifying the potential threats which may disrupt access to information networks. In order to gain a more comprehensive understanding of these various threats, it can be useful to regroup them along the following categories: – exploitation purposes, such as "advanced persistent threats" for economic and political espionage purposes (e.g. GhostNet), identity theft, the recent attacks against the Emissions Trading System etc; – disruption purposes, such as Distributed Denial of Service attacks or spamming generated via botnets (e.g. the Conficker network of 7 million machines) ; – destruction purposes, which is a scenario that has not yet materialised but, cannot be ruled out for the years to come. In order to counter these threats, the Commission highlights some of the actions it has taken: 1) Preparedness and prevention: · the establishment of the European Forum of Member States (EFMS) made significant progress in fostering discussion and exchanges related to security and resilience of ICT infrastructures; · the European Public-Private Partnership for Resilience (EP3R) aims at fostering the cooperation between the public and the private sectors on strategic EU security and resilience policy issues; · the creation of a network of well-functioning National/Governmental CERTs in all Member States by 2012, which will be the backbone of the European Information Sharing and Alert System (EISAS) for citizens and SMEs. 2) Detection and response: ENISA devised a high-level roadmap for the development of a European Information Sharing and Alert System (EISAS) by 2013. 3) Mitigation and recovery: so far only 12 Member States that have organised exercises for large-scale network security incident response and disaster recovery. The first pan-European exercise on large-scale network security incidents (Cyber Europe 2010) took place on 4 November 2010 with the involvement of all Member States, plus Switzerland, Norway and Iceland. Future pan-European cyber exercises would undoubtedly benefit from a common framework. 4) International cooperation: the Commission will discuss and promote the principles with relevant stakeholders, in particular the private sector (via EP3R), bilaterally with key international partners, in particular the US, as well as multilaterally. It will do so, within its competences, in fora such as G8, OECD, NATO, etc. 5) Criteria for European Critical Infrastructures in the ICT sector: the technical discussion in EFMS led to a first draft of the ICT sector-specific criteria for identifying European Critical Infrastructures, with a focus on fixed and mobile communications and the Internet. The technical discussion will continue and benefit from the consultations on the draft criteria, at national and European (via EP3R) level, with the private sector. The Commission will also discuss with Member States the ICT sector- specific elements to be considered for the review of the Directive on the identification and designation of European critical infrastructures and the assessment of the need to improve their protection in 2012. Next steps: in the face of global challenges, the Commission will: · promote principles for the resilience and stability of the Internet: international principles for the resilience and stability of the Internet should be developed with other countries, with international organisations and, where appropriate, with global private- sector organisations – by using existing fora and processes, such as those related to Internet Governance. These principles should serve as a tool for all stakeholders to frame their activities, relating to the stability and resilience of the Internet; · build strategic international partnerships: strategic partnerships should be built on ongoing efforts in critical areas, like cyber-incident management, including exercises and cooperation among CERTs. The engagement of the private sector, which operates on a global scale, is of paramount importance. The EU-U.S. Working Group on Cyber-security and Cyber-crime is an important step in this direction. The Working Group will focus on cyber incident management, public-private partnerships, awareness raising and cyber-crime. On the European side, key factors for success would be good coordination between all EU institutions, relevant agencies (in particular ENISA and Europol) and Member States. · develop trust in the cloud: it is essential to strengthen discussions on the best governance strategies for emerging technologies with a global impact, such as cloud computing. Member States are called upon to: · enhance EU preparedness by establishing a network of well functioning National/Governmental CERTs by 2012. This activity will also advance the development of a European Information Sharing and Alert System (EISAS) to the wider public by 2013; · establish a European cyber-incident contingency plan by 2012 and regular pan-European cyber exercises. Future pan-European cyber exercises should be based on a European cyber incident contingency plan that builds upon and interlinks with national contingency plans. Such a plan should provide the baseline mechanisms and procedure for communications between Member States and, last but not least, support the scoping and organisation of future pan-European exercises. ENISA will work with Member States on the development of such a European cyber incident contingency plan by 2012; · ensure European coordinated efforts in international fora and discussions on enhancing security and resilience of Internet. Member States should cooperate together and with the Commission on promoting the development of an approach based on principles or norms to the issue of the global stability and resilience of the Internet. It should be noted than an Annex to the Communication gives a detailed overview of achievements of the CIIP action plan as well as the next steps.
activities/1/docs/0/title	changed	Old PE474.017 New COM(2011)0163
activities/1/docs/0/type	changed	Old Committee draft report New Non-legislative basic document published
activities/1/docs/0/url	changed	Old http://www.europarl.europa.eu/sides/getDoc.do?type=COMPARL&mode=XML&language=EN&reference=PE474.017 New http://eur-lex.europa.eu/smartapi/cgi/sga_doc?smartapi!celexplus!prod!DocNumber&lg=EN&type_doc=COMfinal&an_doc=2011&nu_doc=163
activities/1/type	changed	Old Committee draft report New Non-legislative basic document
activities/4/date	changed	Old 2012-04-25 New 2012-02-07
activities/4/docs	added	url http://www.europarl.europa.eu/sides/getDoc.do?type=COMPARL&mode=XML&language=EN&reference=PE474.017 type Committee draft report title PE474.017
activities/4/type	changed	Old EP 1R Committee New Committee draft report

activities/8	added	body EP date 2012-05-09 type EP 1R Plenary
activities/8	deleted	date 2012-05-09 body EP type Indicative plenary sitting date, 1st reading/single reading
activities/9	added	body EC date 2012-05-09 type Prev DG PRES commission DG url http://ec.europa.eu/dgs/information_society/index_en.htm title Information Society and Media Commissioner KROES Neelie
activities/10	added	date 2012-05-21 body EP type Indicative plenary sitting date, 1st reading/single reading

activities/4	added	date 2011-11-17 body EP type Committee referral announced in Parliament, 1st reading/single reading committees body EP responsible False committee_full Foreign Affairs committee AFET body EP shadows group EPP name VAN NISTELROOIJ Lambert group ALDE name CREUTZMANN Jürgen group ALDE name THEURER Michael group Verts/ALE name BÜTIKOFER Reinhard group ECR name TOŠENOVSKÝ Evžen group EFD name TZAVELA Niki responsible True committee ITRE date 2011-06-07 committee_full Industry, Research and Energy rapporteur group S&D name KALFIN Ivailo body EP responsible False committee LIBE date 2011-11-23 committee_full Civil Liberties, Justice and Home Affairs rapporteur group EPP name HANKISS Ágnes
activities/4	deleted	date 2011-11-17 body EP type Committee referral announced in Parliament, 1st reading/single reading committees body EP responsible False committee_full Foreign Affairs committee AFET body EP shadows group EPP name VAN NISTELROOIJ Lambert group ALDE name CREUTZMANN Jürgen group ALDE name THEURER Michael group Verts/ALE name BÜTIKOFER Reinhard group ECR name TOŠENOVSKÝ Evžen group EFD name TZAVELA Niki responsible True committee ITRE date 2011-06-07 committee_full Industry, Research and Energy rapporteur group S&D name KALFIN Ivailo body EP responsible False committee LIBE date 2011-11-23 committee_full Civil Liberties, Justice and Home Affairs rapporteur group EPP name HANKISS Ágnes
committees/1	added	body EP shadows group EPP name VAN NISTELROOIJ Lambert group ALDE name CREUTZMANN Jürgen group ALDE name THEURER Michael group Verts/ALE name BÜTIKOFER Reinhard group ECR name TOŠENOVSKÝ Evžen group EFD name TZAVELA Niki responsible True committee ITRE date 2011-06-07 committee_full Industry, Research and Energy rapporteur group S&D name KALFIN Ivailo
committees/1	deleted	body EP shadows group EPP name VAN NISTELROOIJ Lambert group ALDE name CREUTZMANN Jürgen group ALDE name THEURER Michael group Verts/ALE name BÜTIKOFER Reinhard group ECR name TOŠENOVSKÝ Evžen group EFD name TZAVELA Niki responsible True committee ITRE date 2011-06-07 committee_full Industry, Research and Energy rapporteur group S&D name KALFIN Ivailo

activities/0/docs/0/url	added	http://eur-lex.europa.eu/smartapi/cgi/sga_doc?smartapi!celexplus!prod!DocNumber&lg=EN&type_doc=COMfinal&an_doc=2011&nu_doc=0163
activities/2/docs/0/url	added	http://eur-lex.europa.eu/smartapi/cgi/sga_doc?smartapi!celexplus!prod!DocNumber&lg=EN&type_doc=COMfinal&an_doc=2011&nu_doc=0163
activities/4	added	date 2011-11-17 body EP type Committee referral announced in Parliament, 1st reading/single reading committees body EP responsible False committee_full Foreign Affairs committee AFET body EP shadows group EPP name VAN NISTELROOIJ Lambert group ALDE name CREUTZMANN Jürgen group ALDE name THEURER Michael group Verts/ALE name BÜTIKOFER Reinhard group ECR name TOŠENOVSKÝ Evžen group EFD name TZAVELA Niki responsible True committee ITRE date 2011-06-07 committee_full Industry, Research and Energy rapporteur group S&D name KALFIN Ivailo body EP responsible False committee LIBE date 2011-11-23 committee_full Civil Liberties, Justice and Home Affairs rapporteur group EPP name HANKISS Ágnes
activities/4	deleted	date 2011-11-17 body EP type Committee referral announced in Parliament, 1st reading/single reading committees body EP responsible False committee_full Foreign Affairs committee AFET body EP shadows group EPP name VAN NISTELROOIJ Lambert group ALDE name CREUTZMANN Jürgen group ALDE name THEURER Michael group Verts/ALE name BÜTIKOFER Reinhard group ECR name TOŠENOVSKÝ Evžen group EFD name TZAVELA Niki responsible True committee ITRE date 2011-06-07 committee_full Industry, Research and Energy rapporteur group S&D name KALFIN Ivailo body EP responsible False committee LIBE date 2011-11-23 committee_full Civil Liberties, Justice and Home Affairs rapporteur group EPP name HANKISS Ágnes
activities/5	added	date 2012-02-07 docs url http://www.europarl.europa.eu/sides/getDoc.do?type=COMPARL&mode=XML&language=EN&reference=PE474.017 type Committee draft report title PE474.017 body EP type Committee draft report
activities/5	deleted	date 2012-02-07 docs type Committee draft report title PE474.017 body EP type Committee draft report
committees/1	added	body EP shadows group EPP name VAN NISTELROOIJ Lambert group ALDE name CREUTZMANN Jürgen group ALDE name THEURER Michael group Verts/ALE name BÜTIKOFER Reinhard group ECR name TOŠENOVSKÝ Evžen group EFD name TZAVELA Niki responsible True committee ITRE date 2011-06-07 committee_full Industry, Research and Energy rapporteur group S&D name KALFIN Ivailo
committees/1	deleted	body EP shadows group EPP name VAN NISTELROOIJ Lambert group ALDE name CREUTZMANN Jürgen group ALDE name THEURER Michael group Verts/ALE name BÜTIKOFER Reinhard group ECR name TOŠENOVSKÝ Evžen group EFD name TZAVELA Niki responsible True committee ITRE date 2011-06-07 committee_full Industry, Research and Energy rapporteur group S&D name KALFIN Ivailo

Email subscription

Parltrack

2011/2284(INI)

Activites

Documents

Votes

A7-0167/2012 - Ivailo Kalfin - § 16/2

A7-0167/2012 - Ivailo Kalfin - § 26/2

A7-0167/2012 - Ivailo Kalfin - § 39/2

A7-0167/2012 - Ivailo Kalfin - Considérant A/2

A7-0167/2012 - Ivailo Kalfin - Recital A/2

A7-0167/2012 - Ivailo Kalfin - Considérant G/2

A7-0167/2012 - Ivailo Kalfin - Recital G/2

A7-0167/2012 - Ivailo Kalfin - Considérant K/2

A7-0167/2012 - Ivailo Kalfin - Recital K/2

A7-0167/2012 - Ivailo Kalfin - Résolution

A7-0167/2012 - Ivailo Kalfin - Resolution

History