Protect infrastructures

Critical infrastructure can be damaged, destroyed or disrupted by deliberate acts of terrorism, natural disasters, negligence, accidents or computer hacking, criminal activity and malicious behaviour. To save the lives and property of people at risk in the EU from terrorism, natural disasters and accidents, any disruptions or manipulations of CI should, to the extent possible, be brief, infrequent, manageable, geographically isolated and minimally detrimental to the welfare of the MS, their citizens and the European Union.

"This page of the Sub-section related to the European fight against terrorism gives a general presentation in two parts: Part I covers the latest developments which occurred within the recent years. Part II gives a general view of the accomplishments and the acquis at European level of the matter concerned."

I Latest Developments

The damage or loss of a piece of infrastructure in one MS may have negative effects on several others and on the European economy as a whole. This is becoming increasingly likely as new technologies (e.g. the Internet) and market liberalisation (e.g. in electricity and gas supply) mean that much infrastructure is part of a larger network. In such a situation protection measures are only as strong as their weakest link. This means that a common level of protection may be necessary. A common EU level framework (EPCIP) for the protection of critical infrastructure in Europe is now being considered to make sure that each MS is providing adequate and equal levels of protection concerning their critical infrastructure and that the rules of competition within the internal market are not distorted.

Critical infrastructure protection is by nature a very complex and far reaching issue, and EPCIP involves setting up a new policy area within the European Union which cuts across a large number of critical infrastructure sectors and organisational boundaries. To meet the overall purpose of EPCIP and secure added value, it is vital that attention is aimed at the areas of greatest risk. This requires an in-depth knowledge about vulnerabilities, dependencies and interdependencies, existing critical infrastructure protection measures etc.

A wide range of activities in the protection field are currently underway. In November 2005, the Commission adopted a Green Paper on a European Programme for Critical Infrastructure Protection (PDF File 220 KB)(EPCIP) [COM (2005) 576 final]. The Green Paper provides options on how the Commission may respond to the Council’s request to establish EPCIP and the Critical Infrastructure Warning Information Network (CIWIN) and constitutes the second phase of a consultation process concerning the establishment of EPCIP that began with a Commission Communication on critical Infrastructure Protection that was adopted in October 2004 (COM (2004) 702 final).

The options presented by the EPCIP Green Paper are a combination of measures and are to be viewed as complementary to current national efforts. The proposal for the Programme should be put forward in the first half of 2006 and will create an overall framework for the protection of key infrastructures in Europe. EPCIP will address such key issues as the main definitions, principles, division of responsibilities between the Member States and EU, the rights and obligations of critical infrastructure owners/operators.

II General Context

Disasters do not respect national boundaries and they often affect several jurisdictions. Europeans however expect critical infrastructures to continue to function, regardless of which organisations own or operate the component parts.

Critical infrastructure (CI) can be damaged, destroyed or disrupted by deliberate acts of terrorism, natural disasters, negligence, accidents or computer hacking, criminal activity and malicious behaviour. To save the lives and property of people at risk in the EU from terrorism, natural disasters and accidents, any disruptions or manipulations of CI should, to the extent possible, be brief, infrequent, manageable, geographically isolated and minimally detrimental to the welfare of the Member States (MS), their citizens and the European Union. The recent terrorist attacks in Madrid and London have highlighted the risk of terrorist attacks against European infrastructure. The EU’s response must therefore be swift, coordinated and efficient.

The damage or loss of a piece of infrastructure in one MS may have negative effects on several others and on the European economy as a whole. This is becoming increasingly likely as new technologies (e.g. the Internet) and market liberalisation (e.g. in electricity and gas supply) mean that much infrastructure is part of a larger network. In such a situation protection measures are only as strong as their weakest link. This means that a common level of protection may be necessary. A common EU level framework (EPCIP) for the protection of critical infrastructure in Europe will make sure that each MS is providing adequate and equal levels of protection concerning their critical infrastructure and that the rules of competition within the internal market are not distorted.

EPCIP will contain a clear definition of critical infrastructure and will set out the key principles for protection of critical infrastructure at EU level. It will identify the responsibilities of the Member States concerning the protection of critical infrastructure and will set out the role of the EU in supporting this work. It will also establish guidelines for working with the private sector and other stakeholders. Finally, EPCIP will identify priority critical infrastructure protection areas.

In June 2004 the European Council asked the Commission to prepare an overall strategy to protect critical infrastructure. In response, the Commission adopted on 20 October 2004 a Communication “Critical Infrastructure Protection in the Fight against Terrorism” putting forward clear suggestions on what would enhance European prevention, preparedness and response to terrorist attacks involving critical infrastructures (CI). In December 2004, the Commission’s intention to propose a European Programme for Critical Infrastructure Protection (EPCIP) and set-up a Critical Infrastructure Warning Information Network (CIWIN) was endorsed.