8 Critical Infrastructure Warning Network
| (30103) 15041/08 + ADDs 1-2 COM(08) 676
| Draft Council Decision on a Critical Infrastructure Warning Network (CIWIN)
|
| Legal base | Article 308 EC, Article 203 EAEC; consultation; unanimity
|
| Document originated | 27 October 2008
|
| Deposited in Parliament | 6 November 2008
|
| Department | Home Office |
| Basis of consideration | Minister's letter of 4 February 2009
|
| Previous Committee Report | HC 19-iii (2008-09) chapter 8 (14 January 2009),
See also (28183) 16932/06 and (28184) 16933/06:
HC 41-xv (2006-07), chapter 2 (21 March 2007); (27421) 7766/06 and (27542) 9586/1/06 REV1: HC 34-xxxiv (2005-06), chapter 14 (5 July 2006); (27052) 14910/05: HC 34-xxviii (2005-06), chapter 16 (10 May 2006), HC 34-xiv (2005-06), chapter 8 (11 January 2006); and (26072) 13979/04: HC 38-v (2004-05), chapter 5 (26 January 2005)
|
| To be discussed in Council | No date set
|
| Committee's assessment | Legally and politically important
|
| Committee's decision | Not cleared
|
Background
8.1 A European Programme for Critical Infrastructure Protection
(EPCIP) was proposed by the Commission in 2004. 'Critical infrastructure'
for these purposes consists of those facilities and networks,
services and assets the destruction or disruption of which would
have a serious impact on the health, safety or security of economic
well-being of citizens or the effective functioning of government
in the Member States. Such infrastructure includes systems for
electricity and gas production and distribution, telephone exchanges
and other communications systems, sewage plants, food distribution
and key government services.
8.2 Both we and the previous Committee expressed
concern that the Programme appeared to mark a significant extension
of Community competence and of the role of the Commission into
the sensitive area of national security. We were particularly
concerned by the proposal for a Directive to be adopted under
Article 308 EC which would provide for the identification by individual
Member States of relevant infrastructures and for their designation
by the Commission as "European critical infrastructure".
We saw little or no benefit being obtained from the adoption of
a legally binding Directive as opposed to arrangements for voluntary
cooperation between the Member States and considered that the
adoption of such an instrument as a measure of Community law could
well lead to unpredictable results.
8.3 The Programme envisaged by the Commission included
a Critical Infrastructure Warning Information Network (CIWIN),
a network of critical infrastructure protection specialists from
the Member States, which would assist in stimulating an exchange
of information on shared threats and vulnerabilities and on appropriate
measures and strategies to mitigate risk.
8.4 The Communication on EPCIP (which also outlined
the CIWIN network), together with the proposed draft Directive
were debated on the Floor of the House on 2 May 2007. The terms
of the Motion noted that the Government's support for the adoption
of the documents was subject to the satisfactory resolution of
outstanding concerns with certain elements of the Directive, including
the criteria for defining European critical infrastructure, the
absence of a provision requiring a Member State's consent before
infrastructure in its territory was designated, the security of
information provided as part of the protection of national infrastructure,
and the imposition of legal requirements for owners and operators
to produce operator security plans and appoint security liaison
officers.
8.5 Although the Council reached a political agreement
on the Directive in June 2008, the Council also agreed that lists
of European Critical Infrastructure would not be created
The draft Council Decision
8.6 The draft Council Decision seeks to establish
a Critical Infrastructure Warning Network (CIWIN). The CIWIN network
would assist Member States in the exchange of information on shared
threats, vulnerabilities and appropriate measures and strategies
to mitigate risks related to the protection of critical infrastructure.
Participation in and use of CIWIN is open to all Member States.
Such participation is, however, conditional on the signature of
a Memorandum of Understanding on the technical and security requirements
applying to CIWIN and information on the sites to be connected
to CIWIN. The CIWIN network is to consist of an "electronic
forum" for the exchange of information relating to critical
infrastructure. The "electronic forum" is to be composed
of "fixed areas" and "dynamic areas". The
fixed areas are determined under Annex I and include areas for
each Member State. They also comprise "sector areas"
for the chemical industry, energy, financial, food, health, information
technology, nuclear fuel-cycle industry, research facilities,
space, transport and water sectors. The "dynamic areas"
are created on demand and serve a specific purpose. Unlike the
"fixed areas", the dynamic areas are not definitively
fixed in an annex.
8.7 Article 6 provides for the Commission to be responsible
for the technical development and management of the CIWIN, including
its IT structure and "the elements for information exchange".
The Commission is also empowered to lay down guidelines for the
use of the system, including "confidentiality, transmission,
storage, filing and deletion of information. The Commission is
also empowered to "establish the terms and procedures for
granting full or selective access to the CIWIN".
8.8 Article 7 makes provision for the security of
information held on the CIWIN network, which is to be capable
of handling information up to the level of "RESTREINT UE".[38]
The Commission is to decide on the most appropriate technological
platform for the CIWIN and users will be required to meet the
technical requirements fixed by the Commission. User guidelines
on the functionalities and roles of the CIWIN network are also
a matter to be determined by the Commission (Article 8).
8.9 Article 9 provides for the costs of the operation,
maintenance and "central functioning" of the CIWIN network
to be borne by the Community budget, but for costs related to
users' access from the participating Member States to be borne
by the participating Member States.
The Government's view
8.10 In his Explanatory Memorandum of 2 December
2008 the Parliamentary Under-Secretary of State at the Home Office
(Admiral the Lord West of Spithead) explained that the proposal
for a critical infrastructure network (CIWIN) is part of the Commission's
proposals for a European Programme for Critical Infrastructure
Protection (EPCIP). The Minister explained that it will be for
the Commission to identify the most appropriate technological
platform for CIWIN, but that it is likely that this will be the
new secure EU Trans European Services for Telematics between Administrations
(sTESTA) which will replace several data communication infrastructures
at EU level and which is currently subject to a security accreditation
process which will allow it to exchange classified information
up to the "EU RESTRICTED" level.
8.11 On the policy implications of the proposal the
Minister noted that the protection of critical infrastructure
is an issue of high priority in the UK. The Minister added that
the Government considered it important for it fully to engage
in the development of the European Programme on critical infrastructure
protection, and thereby to clarify the added value that the European
Union can bring. The Minister noted that many countries, including
the UK, have highly developed processes in place for critical
infrastructure protection and well-established bilateral arrangements
for international cooperation and information sharing. The Minister
also noted that participating Member States will need to sign
a Memorandum of Understanding which will contain details of technical
and security requirements, but that no draft was yet available.
8.12 Of the two separate functions envisaged for
CIWIN (namely the provision of a secure forum for the exchange
of information and an EU-wide rapid alert system) the Minister
informed us that, subject to reassurance that information relating
to the protection of critical infrastructure is adequately protected,
the Government supports the concept of sharing information as
this would enable the current sharing of UK critical national
infrastructure information with European countries to be achieved
more efficiently. The Minister added that, in principle, there
will be reciprocal benefits to the UK from the information that
will be more readily available from other Member States, and that
an additional benefit arises from the proposal through the Commission's
commitment to translate documents deposited in the CIWIN into
other EU languages.
8.13 The Minister stated that it was less clear
what additional benefits the proposed EU-wide rapid alert system
would bring. The Minister indicated that the UK would prefer to
see the proposal split into two separate proposals, one for information
exchange and one for a rapid alert system.
8.14 In subsequent letters of 2 and 15 December 2008
the Minister informed us that the Commission was considering a
revision of its proposal so that the CIWIN would no longer have
any function as a rapid alert system but would be confined to
being an information sharing network. The Minister indicated that
negotiation on any new proposal would be undertaken during the
Presidency of the Czech Republic.
The Minister's Letter of 4 February 2009
8.15 In his letter of 4 February 2009, the Minister
confirms that the revised proposal no longer includes a rapid
alert system, thereby reducing CIWIN to an information sharing
tool for participating Member States. He also confirms that the
guidelines for access to CIWIN are likely to amount to no more
than a "technical user manual", which will be agreed
in consultation between the Commission and Member States. They
will not therefore be subject to a formal agreement by the Member
States in the Council.
8.16 Concerning the legal base, the Minster states:
"Council Directive 2008/114/EC on the identification
and designation of European critical infrastructure was adopted
on 8 December 2008 on the basis of Article 308. The Directive
provided that it was establishing procedures for the identification
and designation of European critical infrastructure in order to
contribute to the protection of people. Measures on civil protection
may be adopted using Article 308, civil protection being listed
as one of the Community's activities and there being no specific
civil protection legal base.
"The CIWIN proposal forms part of the European
Programme for Critical Infrastructure Protection (EPCIP) and will
complement Directive 2008/114 and, like that Directive, may properly
be adopted under Article 308. We do not see any risk of use of
Article 308 for CIWIN extending Community competence into national
security. The objective of the proposal is not to combat crime,
including terrorism, nor is it a national security measure. It
is concerned with improving the protection of infrastructure from
a range of threats, as part of EPCIP."
Our assessment of the proposal in light of the
Minister's reply
8.17 We thank the Minister for his further letter.
It answers the concern we raised in our previous Report about
the propriety of the Commission being given an extensive role
in the formulation of guidelines on access to and use of CIWIN.
We accept the Minister's assurance that the guidelines will now
amount to no more than a user manual and will not unduly enhance
the Commission's influence over CIWIN. We would of course expect
to be informed should the role of these guidelines change.
8.18 But the Minister's letter does not allay our
concern over the choice of Article 308 EC as the legal base for
this Council Decision. The Minster states that "there is
no risk of the use of Article 308 EC for CIWIN extending Community
competence into national security: It is concerned with improving
the protection of infrastructure from a range of threats, as part
of EPCIP".
8.19 We are surprised by this statement. The first
paragraph of the Commission's explanatory memorandum, under the
heading "grounds for and objectives of the proposal",
would seem to contradict it. It provides as follows:
"The European Council of June 2004 asked the
Commission to prepare an overall strategy to protect critical
infrastructure. On 20 October 2004 the Commission adopted a Communication
on Critical Infrastructure Protection in the Fight against
Terrorism, putting forward suggestions on ways of enhancing
European prevention, preparedness and response in the event
of terrorist attacks involving critical infrastructures. The
Council conclusions on "Prevention, Preparedness and Response
to Terrorist Attacks" and the "EU Solidarity
Programme on the Consequences of Terrorist Threats and Attacks"
adopted in December 2004 endorsed the Commission's plan to propose
a European Programme for Critical Infrastructure Protection (EPCIP)
and agreed to the Commission setting up a Critical Infrastructure
Warning Information Network (CIWIN)." (Emphasis added.)
8.20 The explanatory memorandum further clarifies:
"The CIWIN initiative is part of EPCIP, being
concerned more specifically with the information-sharing process
between EU Member States and an information technology system
to support that process."
8.21 The place of the proposal in the scheme of the
EU's fight against terrorism is also confirmed in the draft Decision
itself, in the very first recital:
"The Council Conclusions on 'Prevention, Preparedness
and Response to Terrorist Attacks' and the 'EU Solidarity
Programme on the Consequences of Terrorist Threats and Attacks'
adopted by Council in December 2004 endorsed the Commission's
intention to propose a European programme for Critical Infrastructure
Protection and agreed to the Commission setting up CIWIN."
(Emphasis added.)
8.22 The eighth recital also confirms that the "interdependence
of critical infrastructure in Member States and varying levels
of CIP [Critical Infrastructure Protection] in Member States suggest
that creating a horizontal and cross sectoral Community tool for
the exchange of information would increase the security of
citizens". (Emphasis added.)
8.23 So the Minister's assertion that the objective
of the proposal "is not to combat crime, including terrorism"
is contradicted by the proposal itself and the accompanying explanatory
memorandum. It is also contradicted by the first paragraph of
his own Explanatory Memorandum of 2 December 2008, which merges
passages from the Commission's explanatory memorandum and the
first recital of the draft Decision, quoted above, into one opening
paragraph. And, for additional confirmation of the appropriate
context of this proposal, paragraph 39 of the Explanatory Memorandum
explains, in relation to funding, that "the [European Community]
programme 'Prevention, Preparedness and Consequence Management
of Terrorism and other Security Related Risks' for the period
2007-2013 will play a part in implementing this decision".
8.24 It is clear, therefore, that the proposal has
been inspired by the EU's fight against terrorism — there
is no doubt that this is the ultimate purpose to which it is addressed
— which is an objective not of the EC but of the EU Treaty
(Article 29). In our view, the draft Decision cannot therefore
lawfully rely on Article 308 EC as a legal base. It is fallacious
to state that civil protection is listed as one of the Community's
activities, hence Article 308 EC is warranted: the overall aim
of Community legislation is very relevant to legal base. And to
argue that similar EC legislation dealing with critical infrastructure
has in the past been based on Article 308 EC would simply be to
justify the continued use of an inappropriate legal base.
8.25 The consequences of misusing Article 308 EC
are serious. Not only would it set a unwelcome precedent, making
it easier for this Article be used in the future for objectives
which do not fall within the Community's scope; it would also
expose this aspect of the fight against terrorism to the Community
legal order, including making it subject to the compulsory jurisdiction
of the European Court of Justice, which goes very much against
the intentions of the drafters of Title VI of the EU Treaty.
Conclusion
8.26 We thank the Minister for his further letter
of 4 February 2009. We accept the Minister's assurance that the
guidelines will now amount to no more than a user manual and will
not unduly enhance the Commission's influence over CIWIN. We would
of course expect to be informed should the role of these guidelines
change.
8.27 But the letter does not allay our concern
over the choice of Article 308 EC as the legal base for this Council
Decision. The Minster states that there is no risk of the use
of Article 308 EC for CIWIN extending Community competence into
national security: "[t]he objective of the proposal is not
to combat crime, including terrorism, nor is it a national security
measure." This assertion is, however, contradicted by the
first paragraph of the Commission's explanatory memorandum, the
first recital of the draft Decision, and the first paragraph of
the Minster's Explanatory Memorandum of 2 December 2008, all of
which demonstrate with crystal clarity that the proposal is part
of the EU's strategy to combat the effects of terrorism. And,
in terms of funding, the Explanatory Memorandum further confirms
that CIWIN will in part be funded by an EC programme entitled
'Prevention, Preparedness and Consequence Management of Terrorism
and other Security Related Risks'.
8.28 It is clear, therefore, that the proposal
has been inspired by the EU's fight against terrorism —
there is no doubt that this is the ultimate purpose to which it
is addressed — which is an objective not of the EC
but of the EU Treaty (Article 29). In our view, the draft Decision
cannot therefore lawfully rely on Article 308 EC as a legal base.
8.29 The consequences of misusing Article 308
EC are serious. Not only would it set an unwelcome precedent,
making it easier for this Article be used in the future for objectives
which do not fall within the Community's scope; it would also
expose this aspect of the fight against terrorism to the Community
legal order, including making it subject to the compulsory jurisdiction
of the European Court of Justice, which goes very much against
the intentions of the drafters of Title VI of the EU Treaty.
8.30 We therefore urge the Minister to re-consider
the legal base of this proposal. In the meantime we shall keep
the document under scrutiny.
38 Presumably, this will be rendered into English as
'RESTRICTED EU'. It is, nevertheless, a relatively low level of
classification. Back
| 
