2 Protection of critical infrastructure
| (a)
(28183)
16932/06
COM(06) 786
(b)
(28184)
16933/06
+ ADDs 1-2
COM(06) 787
|
Commission Communication on a European Programme for Critical Infrastructure Protection
Draft Council Directive on the identification and designation of European Critical Infrastructure and the assessment of the need to improve their protection
|
| Legal base | (a)—
(b) Article 308 EC; consultation; unanimity
|
| Department | Home Office |
| Basis of consideration | Minister's letter of 9 March 2007
|
| Previous Committee Report | HC 41-x (2006-07), para 8 (21 February 2007); and see (26072) 13979/04 HC 38-v (2004-05), para 5 (26 January 2005), HC 34-xiv (2005-06) para 8 (10 February 2005) and (27052) 14910/05 HC 34-xviii (2005-06), para 12 (8 February 2006), HC 34-xxviii (2005-06) para 16 (10 May 2006)
|
| To be discussed in Council | No date set
|
| Committee's assessment | Legally and politically important
|
| Committee's decision | For debate on the Floor of the House
|
Background
2.1 We considered the Commission Communication and draft Directive
on 21 February. We noted that "critical infrastructure"
for these purposes consists of those facilities and networks,
services and property the destruction of which would have a serious
impact on the health, safety, security or economic well-being
of citizens or the effective functioning of government in the
Member States and that such infrastructure would include systems
for electricity and gas production and distribution, telephone
exchanges and other communications systems, sewage plants, food
distribution and key government services.
2.2 We noted that the Commission Communication (document
(a)) set out the principles, processes and instruments which the
Commission proposes for a "European Programme for Critical
Infrastructure Protection" (EPCIP) which, while based on
an "all hazard" approach, would address the threat from
terrorism as a priority. Although the Commission described subsidiarity
as a "key principle", and that it would focus its efforts
on infrastructure which was critical from a European, rather than
a national or regional perspective, European critical infrastructure
was described as including infrastructure the disruption or destruction
of which would affect two or more Member States, or a single Member
State if the critical infrastructure was located in another Member
State. So defined, the programme would affect purely bilateral
arrangements between Member States.
2.3 The proposal for a Directive (document (b)) would
be adopted under Article 308 EC, and would provide for the identification
by the Member States of relevant infrastructures and for their
designation by the Commission as "European critical infrastructure".
We noted that the reasons for the choice of Article 308 EC were
not explained and, in particular, that it was not explained how
the proposal, which relates essentially to national security,
was nevertheless necessary to attain, in the course of the operation
of the common market, one of the objectives of the Community.
2.4 We noted that the Government supported, in principle,
the Commission's decision to implement the EPCIP through a combination
of binding and non-binding measures and that it considered that
the use of a Directive to implement the basic elements for the
cross-border components of the EPCIP would "allow the Commission
to make these requirements obligatory for Member States whilst
still allowing the Member States to adapt the obligations to their
particular legal systems and existing CIP procedures". We
also noted that the Government nevertheless had concerns in relation
to the Directive, in particular, the definition of "European
Critical Infrastructure" (ECI) as infrastructures which are
critical to two or more Member States (whereas the Government
believed that the EPCIP should focus on infrastructures which
are critical to at least three Member States), the omission of
any provision allowing a Member State to challenge the designation
of infrastructure located within its territory as ECI, the imposition
of legal obligations on infrastructure operators to produce Operator
Security Plans and to provide Security Liaison Officers and the
risks of sharing sensitive information.
2.5 We agreed with the general observations the Minister
has made on subsidiarity and the scope of the policy for critical
infrastructure protection at EU level and saw no reason for Commission
involvement in bilateral cooperation between two Member States
in relation to critical infrastructure which is of concern to
those Member States.
2.6 We noted that the Communication envisaged an
extensive role for the Commission, but did not even mention the
role of the European Union Counter-Terrorism Coordinator (Mr Gijs
de Vries). We asked the Minister to explain if the Counter-Terrorism
Coordinator had been consulted and what role was envisaged for
him in the development of the EPCIP policy.
2.7 We considered the adoption of an EC Directive
in this area to be of doubtful legality and questionable in principle.
It did not appear to us that a measure which was concerned essentially
with the national security of Member States was a matter falling
within the EC Treaty at all, and still less under Article 308
EC. We asked the Minister to reconsider if this proposal was properly
made under Article 308 EC.
2.8 In addition to the question of the legal base,
the adoption of a Directive in this sensitive area seemed to us
to be inappropriate. We questioned whether policy in this area
of such sensitivity to the Member States was really appropriate
for a binding legal instrument in the form of a Directive and
for judicial determination at EC level and asked for the Minister's
comments.
2.9 We also asked if any assessment had been made
of the effect on external competence of the European Community
if the Directive were to be adopted and, in particular, what effect
adoption of the proposed Directive might have on the ability of
the United Kingdom to conclude agreements in this field with countries
outside the European Community.
The Minister's reply
2.10 The Minister of State at the Home Office (Tony
McNulty) replies to our questions in his letter of 9 March 2007.
2.11 In relation to the role of the EU Counter-Terrorism
Coordinator (Mr Gijs de Vries), the Minister explains that the
Coordinator has been "aware" of the EPCIP proposals
since their inception, and that a representative from his office
attends the Civil Protection Council working group (ProCiv). The
Minister adds that the future role of the Coordinator in the development
of the EPCIP is "unclear" as the present holder of the
post is due to leave this month, and that if the post is filled,
the duties of the Coordinator "may involve high-level discussions
with EU Member States, ensuring they are aware of EPCIP developments,
and also promoting EPCIP among non-EU countries".
2.12 In relation to the use of Article 308 EC as
a legal base for the proposal, the Minister states that the proposal
is concerned with protecting critical infrastructure against "manmade,
technological and natural disasters, where there is a cross-border
dimension, with the threat from terrorism being given priority".
The Minister argues that reliance on Article 308 EC is justified
for the following reasons:
"Protecting [critical infrastructure] will
further a number of Community objectives. Article 2 of the EC
Treaty refers to the need to promote the sustainable development
of economic activities — such activities could be seriously
affected by the disruption or destruction of critical infrastructure.
Article 3 of the Treaty refers to Community policies on the environment,
transport and civil protection — again these policy areas
could be adversely affected by the disruption or destruction of
critical infrastructure through any means. So the proposal can
be regarded as being necessary for the attainment of a Community
objective, an essential requirement for use of Article 308EC.
"The Community has already taken similar
action in relation to certain sectors: see, for example, Regulation
(EC) 725/2004 on enhancing ship and port facility security. More
recently, the Council adopted Council Decision 2007/124 establishing
a specific programme 'prevention, preparedness and consequence
management of terrorism and other security related risks' under
Article 308. So Community action to protect infrastructure is
not unprecedented. The fact that such action may include requirements
to counter threats from criminal or terrorist activity does not
take it outside of the Community's competence provided that the
action is necessary to attain a Community objective."
2.13 On the question of whether or not a binding
legal instrument was appropriate in this policy area, the Minister
refers to the Commission's Explanatory Memorandum in which it
states that "taking into account the varying approaches and
different legal systems throughout the EU, a Directive is the
best suited instrument for this purpose". The Minister adds
that the Government agrees that a Directive "is an appropriate
mechanism for creating a common procedure for identifying and
designating European Critical Infrastructure".
2.14 We also had concerns that the adoption of a
Directive under the EC Treaty might extend the Community's external
competence and to that extent diminish the power of the United
Kingdom to enter into agreements with third countries in this
field. In relation to this concern, the Minister replies that
under normal Community rules on external competence Member States
would be prevented from entering into bilateral agreements that
could affect the operation of the Directive. The Minister adds
that this would prevent bilateral agreements that "for example,
provided for a different procedure to be used for the identification
of critical infrastructure". The Minister states that the
adoption of the proposal "would not give the Community external
competence generally in relation to protecting critical infrastructure"
and adds that "it is not considered that it would prevent,
for example, bilateral arrangements for the exchange of information
on techniques for protecting infrastructure".
Our assessment of the proposal in the light of
the Minister's reply
2.15 We find the Minister's reply less than wholly
reassuring. In relation to the EU Counter-Terrorism Coordinator,
we are told that the Coordinator was "aware" of the
Commission's EPCIP proposals, but we find it extraordinary that
his role is not even mentioned in the Commission's Communication
or proposed draft Directive. In this connection, we recall that
the European Council on 17 and 18 June 2004 called on the Council
to prepare an overall strategy to enhance the protection of critical
infrastructures "on the basis of a coordinated approach by
the SG/HR[5] and the Commission".[6]
In circumstances where the role of the Council's Counter-Terrorism
Coordinator is not even mentioned in the Commission's proposals,
we find it open to question how far there has been any "coordinated"
approach of the kind referred to by the European Council.
2.16 We find the Minister's arguments to justify
the use of Article 308 EC as a legal base for the draft Directive
to be unconvincing. This is not a case where the proposed Directive
merely "includes" requirements to counter threats from
criminal or terrorist activity, but one where, as the Minister
has himself emphasised, the threat from terrorism was to be "maintained
as the key focus for EPCIP". As such, the measure is concerned
essentially with national security and any internal market effects
are, in our view, merely incidental. In our view, these incidental
economic effects cannot be relied on to justify Community involvement
in the maintenance of national security. We note that even under
the EU Treaty, which envisages a lesser role for the Commission
and ECJ, Article 33 EU makes it clear that Title VI "shall
not affect the exercise of the responsibilities incumbent upon
Member States with regard to the maintenance of law and order
and the safeguarding of internal security". Given such a
clear rule under the EU Treaty, it would be surprising indeed
if a broader competence was conferred under Article 308 EC.
2.17 The Minister refers us to Regulation (EC) No.
725/2004[7] on enhancing
ship and port facility security, and to Council Decision No. 2007/124[8]
adopted under Article 308 EC and establishing a programme on "prevention,
preparedness and consequence management of terrorism and other
security related risks". Whether either of these measures
establishes a precedent for the adoption of a measure under Article
308 EC imposing obligations on Member States in relation to their
national security is open to serious question.
2.18 Regulation (EC) No. 725/2004 was adopted under
Article 80(2) EC, and provides for joint standards for the interpretation,
implementation and monitoring within the Community of the provisions
adopted by the Member States within the International Maritime
Organization (IMO) in 2002 and amending the 1974 International
Convention for the Safety of Life at Sea (SOLAS). The Regulation
is concerned with the operation of IMO standards within the Community
and does not appear to impose any further obligations on Member
States in relation to their national security. Moreover, the fifth
recital to the Regulation states that it operates "without
prejudice to the rules of Member States in the field of national
security and measures which might be taken on the basis of Title
VI of the Treaty on European Union".
2.19 Council Decision No. 2007/124 is concerned essentially
with authorising expenditure on a programme for projects aimed
at preventing or reducing the risks linked to terrorism and concerned
with risk assessments, supporting the development of security
standards and shared operational measures to improve security
in cross-border supply chains and the sharing of know how and
experience. When, on 11 January 2006, we considered the legal
basis of the proposals which became the draft Council Decision
we noted that the Minister had acknowledged that there were "potential
issues" with the use of Article 308 EC for those parts of
the programme relating to the prevention of terrorism.[9]
We commented that there might be an arguable case for adopting
measures relating to civil protection, having regard to the provisions
of Article 3(1)(u) EC, but that there seemed no such case in relation
to measures for the prevention of terrorism. A number of amendments
were subsequently reported to us by the Minister which, in his
words, "reflected that competence for law and order and internal
security rests with Member States and not with the Community".
We nevertheless considered that it would "require vigilance
to ensure that the programme [was] not used as a platform from
which to extend Community competence in this area". It now
appears to us that the present proposal is just the type of measure
which we feared.
2.20 In reply to our question as to the need for
a binding legal instrument in this area of great sensitivity for
the Member States, the Minister confines himself to referring
to the Commission's Explanatory Memorandum and to agreeing that
a Directive is an "appropriate mechanism" for creating
a "common procedure for identifying and designating European
Critical Infrastructure". In so doing, the Minister does
not explain why this objective could not have been achieved by
voluntary cooperation between the Member States.
2.21 In his Explanatory Memorandum, the Minister
himself referred to a number of issues, such as the definition
of European Critical Infrastructure in Article 2, or the disclosure
of information under Articles 3 and 7 and the legal obligations
imposed under Articles 5 and 6 to produce an Operator Security
Plan and appoint a Security Liaison Officer. In each of these
respects, adoption of a Directive would lead to these questions
becoming ones of law to be interpreted and determined by the ECJ,
in many cases as a result of infraction proceedings brought by
the Commission. We note, in this regard, that the Minister stated
that the UK may, for security reasons, "prefer" not
to identify infrastructure in another Member State for the purposes
of Article 3(3) or that it would only share information on the
location of assets on a "need to know" basis under Article
5, or that, in relation to the requirements under Article 7 to
report information to the Commission, the UK would not disclose
sensitive information regarding specific threats or vulnerabilities.
However, each of these obligations, if contained in a Directive,
would be legally binding and the mechanism for enforcing Directives
under the EC Treaty might well lead to unpredictable legal obligations
being imposed on the UK. The wisdom of entering into such a legally
binding arrangement is therefore open to question.
2.22 In relation to external competence, the Minister
confirms that adoption of a Directive would have the consequence
that the UK would be prevented from entering into a bilateral
arrangement with a third country which provided for a different
procedure to be used for the identification of critical infrastructure.
The Minister states that the proposal would not give the Community
external competence generally in relation to protecting criminal
infrastructure and that "it is not considered" that
it would prevent bilateral arrangements for the exchange of information
on techniques for protecting infrastructure. The Minister's remark
leaves it unclear whether this view is one held only by the UK
or whether it is also shared by the Commission. This is again
a matter which is to be determined ultimately by the ECJ, and
it appears to us for that reason to be impossible to be certain
about the point. In our view, this uncertainty creates a further
risk of adopting legally binding measures of Community law in
this area.
Conclusion
2.23 For the reasons we have explained in the
body of our report, we continue to consider that the proposal
for a Directive is legally doubtful and questionable in principle.
2.24 In our view, the House should be given an
early opportunity to debate these proposals. They mark a significant
extension of Community competence and of the role of the Commission
into the sensitive area of national security, with little or no
benefit being obtained from the adoption of a legally binding
Directive as opposed to arrangements for voluntary cooperation
between the Member States. The adoption of such an instrument
as a measure of Community law could well lead to unpredictable
results.
2.25 We consider that these issues are of such
importance to the fundamental duty of any government to ensure
national security that they ought to be debated on the Floor of
the House and we so recommend.
5 I.e. Secretary General/High Representative. Back
6
Paragraph 19, revised Presidency conclusions 10679/2/04 REV 2. Back
7
OJ No L 129 of 29.4.04, p.6. Back
8
OJ No L 58 of 24.2.07, p.1. Back
9
HC 34-xiv (2005-06), para 21 (11 January 2006). Back
| 
