EU Network and Information Security (NIS) resolution officially published

In the blog post EU Network and Information Security (NIS) (27 December 2009) we presented the Council resolution and detailed preparatory work by the Commission, mentioning that the annexed resolution would be published in the Official Journal of the European Union (OJEU), but that in the meantime we followed the Council document.


OJEU


Adhering to the principle to use the most authentic and official sources available, we can now announce the official publication of the Council resolution on NIS, which forms the tip of the iceberg:



COUNCIL RESOLUTION of 18 December 2009 on a collaborative European approach to Network and Information Security, published in the Official Journal of the European Union (OJEU) 29.12.2009 C 321/1.



NIS reasons


At the same time, we can repeat some of the reasons for the importance of NIS action noted by the Council:

II. NOTING THAT:

1. Given the importance of electronic communications, infrastructures and services as a basis of economic and social activity, Network and Information Security (NIS) contributes to important values and objectives in society, such as democracy, privacy, economic growth, the free flow of ideas, and economic and political stability;

2. Information and communication technology systems, infrastructures and services, including the Internet, play a vital role for society, and their disruption has the potential to cause huge economic damage, underlining the importance of measures to increase protection and resilience aimed at ensuring continuation of critical services;

3. Security incidents risk undermining user confidence. While severe disruptions of networks and information systems could have a major economic and social impact, everyday problems and nuisances also risk eroding public confidence in technology, networks and services;

4. The threat landscape is evolving and growing, which increases the need to provide end-users, businesses and governments with electronic communications infrastructures that are robust and resilient by default and to identify the right incentives for the providers to do so in a timely manner;

5. There is a need to enhance and embed Network and Information Security in all policy areas and sectors of society, and to address the challenge of ensuring sufficient skills via both national and European actions and raising awareness among users of information and communication technology (ICT);

6. The completion and functioning of the Internal Market will require that network owners and service providers cooperate across borders, given that possible disruptive events in one Member State may also affect other Member States and the EU as a whole;

7. New usage patterns, such as cloud computing and software as a service, put additional emphasis on the importance of Network and Information Security;

8. Network and Information Security serves the objective of all parties, in all sectors of society, to be able to trust the information systems, therefore a cross-sector and cross-border approach is needed;

9. With the increasing use of ICT in society, Network and Information Security is a prerequisite for the reliable, safe and secure delivery of public services, such as e- Government;

10. ENISA has the potential to build on the important role it already plays in Network and Information Security.

Ralf Grahn



P.S. Read Coulisses de Bruxelles, by Jean Quatremer, and other great euroblogs listed on multilingual Bloggingportal.eu, our common “village well” for fact, opinion and gossip on European affairs.

EU Network and Information Security (NIS)

Have we humans always got our priorities right? If Santa Claus gets a parking ticket for his reindeer, it is front page news around the globe. But without information and communication technologies (ICT) in working order, even that news item would go nowhere. Actually, very little would function in our modern world without secure networks and information.



The 2987th Council meeting, in the Transport, Telecommunications and Energy (TTE) configuration from 17 to 18 December 2009 (document 17456/09), adopted a resolution on network and information security (NIS), a brief mention on page 22:

Network and Information Security

The Council adopted a resolution on a collaborative European approach on network and information security (15841/09).

The resolution responds to the Commission's communication on this subject (8375/09), whose objective is to develop an EU policy on the protection of critical information infrastructure.

Secure information infrastructure got a three line mention, when the Swedish Council presidency summed up the results of the meeting for general consumption.

I am not out to criticise the brief mentions: They are geared towards the interests of the public, and most of the time we seem to look for more immediate pleasures, leaving critical, but “boring” work to specialists.



Resolution details



Council document 15841/09 Council Resolution on collaborative European approach on Network and Information Security – Adoption (dated 8 December 2009; 11 pages) recalls the establishment of the European Network and Information Security Agency (ENISA; Regulation 1007/2008 amending Regulation 460/2004) and initiatives to protect Critical Information Infrastructures (CIIs).

The annexed resolution will be published in the Official Journal of the European Union (OJEU), but in the meantime we follow the Council document.

Among other things the Council underlines that (page 6):
A high level of Network and Information Security in the EU is needed in order to support:

a. the freedoms and rights of citizens, including the right to privacy;

b. an efficient society in terms of quality in information handling;

c. the profitability and growth of trade and industry;

d. citizens’ and organizations’ trust in information handling and ICT systems.

The resolution stresses the need to modernise and reinforce ENISA, and it invites the EU member states to undertake continued efforts to improve network and information security, including by creating Computer Emergency Response Teams (CERTs).

The Commission is invited to support the efforts of the member states, for instance by evaluation and a possible NIS strategy.

ENISA is encouraged to work with all stakeholders, and these to put their best foot forward.


Commission communication



The basic underlying document was the Commissions Communication on Critical Information Infrastructure Protection "Protecting Europe from large scale cyber-attacks and disruptions: enhancing preparedness, security and resilience"; Brussels, 30.3.2009 COM(2009) 149 final (12 pages).



The Communication was accompanied by the Staff Working Document: Summary of impact assessment; Brussels 30.3.2009 SEC(2009) 400 (8 pages).




The full length Impact assessment SEC(2009) 399 came in three parts (addenda): Part 1 (Council document 8375/09 ADD 1; 149 pages), Part 2 (ADD 2; 133 pages) and Part 3 (ADD 3; 130 pages).



Preparation and hierarchy


We are able to see that a few vague sentences in the press releases from the Council and the Swedish presidency are just the tip of the iceberg.

The resolution itself is more detailed, although the phrases still resemble indistinct wishes for constructive action, as often is the case when we deal with cooperation and coordination between sovereign states.

Even when there is need for urgent action, herding 27 member states is a slow and laborious task, often spanning several Council presidencies.

The base of the iceberg is the preparatory work by the Commission, carefully researched and documented, often voluminous. Nosemonkey often stresses how incredibly dull the European Union is.


Few of us have cared to follow this far. We just expect our computers, networks and European Union to function, so that we can see if Santa wins the appeal against his parking ticket. We are all too human.




Ralf Grahn



P.S. Get to know Jon Worth’s Euroblog and other great European blogs listed on multilingual Bloggingportal.eu, our common “village well” for fact, opinion and gossip on European affairs.