Protecting Europe against large-scale cyber-attacks - European Union Committee Contents


29.  The protection of Europe against cyber-attacks is undoubtedly a matter to be dealt with at every level: by individual firms, by network providers, by Governments, and by global initiatives. In this chapter we consider to what extent there is a role for the EU.

A legitimate role

30.  There was consensus among our witnesses that this was a legitimate area for the EU to be concerned about, and that it had some role to play, but there was no unanimity as to what that role should be, and just how extensively the EU as such should be involved. Witnesses generally agreed with the proposition that Internet security issues were either extremely local, or were global in nature. Nonetheless they saw value in regional action, provided that it was proposed within a wider framework and led on to global initiatives. However the Communication, and most of the witnesses, were vague about what form such global initiatives should take.

31.  On 8 December 2008 the Council adopted a Directive on Critical Infrastructure Protection,[21] the purpose of which was to identify and designate European Critical Infrastructures (ECI) which would benefit from a common approach to the improvement of their protection. The first draft of the Directive[22] included "Information, Communication Technologies, ICT" in the long list of critical infrastructure sectors in Annex 1. This Committee had considered that draft in the course of its normal scrutiny of EU legislation and took the view, which the Government shared, that the designation of many categories of sensitive infrastructure as ECI would, because of the wide sharing of information this would entail, not so much protect the infrastructure as potentially put it at risk. During the course of negotiations the scope of the Directive was greatly reduced, and the Directive as adopted, which will in any case not come into force until 2011, includes only energy and transport as ECI sectors. However Mr Andrea Servida from the Commission Directorate General Information, Society and Media, who was one of the authors of the Communication, explained (QQ 111, 116) that the next ECI sector in line was to be the IT sector.[23]

32.  Perhaps surprisingly, those of our witnesses who were most positive about the role the EU could play were two US companies. In written evidence Mr Chantzos, for Symantec, explained: "A European wide approach to critical infrastructure protection would enable the development of a common, shared level of understanding and recognition of the specific critical infrastructures within Member States that need to be protected from online attacks. Also more importantly a pan-European approach is necessary to identify the interdependencies that currently exist in the critical infrastructures shared across Member States [and] ensure risks are identified, assessed and addressed in a way that protects these critical systems against possible attack" (p 54). And Dr Nazario told us: "The EU has a major role to play; it is a common economic system, with common political goals … Engaging with the US is going to be key, I think, for connectivity purposes … So being able to communicate as a single economic voice or a unified voice to software vendors around the world will have a significant impact at raising, for example, software quality standards and software features" (Q 152).

33.  Professor Anderson was also very positive: "I do believe that the European Union has a significant role to play in Internet policy, broadly defined, and that it is going to have an even larger role in the future ... Of course the European Union is going to have a role to play in this. Of course it should have a centre of technical expertise" (Q 263).

Member States with less resilient systems

34.  A number of witnesses saw the main role of the EU as bringing the Member States with less developed systems for handling cyber-attacks up to the level of the most advanced—among which the United Kingdom was always seen as prominent. Improvements would include the addition of redundant capacity as a back-up for existing capacity,[24] and the development of Computer Emergency Response Teams (CERTs).[25] Thus Symantec believed that effectively securing Europe's critical infrastructure network meant having in place a common European-wide approach and strategy. "This is seen as particularly important given that many Member States are at different stages of Internet development and levels of understanding regarding the interconnected nature of networks and level of risk to possible cyber-attack" (p 53).

35.  The same point was made by Europol: "There is clear asymmetrical development; some MS [Member States] are forging ahead with great advances in certain areas, whilst other MS lag behind in terms of technology" (p 124). Mr Geoffrey Smith from the Department for Business, Innovation and Skills (BIS), who with Dr Steve Marsh gave evidence on behalf of the Government, felt that there was a lot the EU could do to improve national protection, in particular encouraging the Member States which were the laggards up to the speed of the front runners (Q 3).

National security

36.  One recurring theme was that, whatever the role of the EU, national security was the exclusive preserve of the Member States. In the first Cyber Security Strategy of the United Kingdom,[26] issued at the same time as the 2009 update of the National Security Strategy of the United Kingdom,[27] the Government undertook to establish the Office of Cyber Security (OCS).[28] This would, among other things, "be responsible for bringing greater coherence to the UK's work with overseas partners and international organisations";[29] but the Cyber Security Strategy contains not a single reference to the EU by name.

37.  Mr Smith, while agreeing that it was only right that the EU should use its influence to enhance the ability of Member States to protect their critical infrastructures, added: "We have to be very clear on what the role of the European Union is, and this is an area where we get into a well trod problem area of national security and what is the responsibility of Member States versus the role of the Community" (Q 3). This was a view shared by Mr Chantzos. He emphasised that "when we are talking about information security we are talking about the issues which impinge upon national sovereignty" (QQ 149, 151).

The wider global context

38.  A second theme, one stressed by the great majority of our witnesses, was that, as the Government said in their written evidence, "the Internet operates as a global phenomenon and does not recognise borders; this is something which should be reflected in any work which takes place to ensure availability of Internet services" (p 9). SOCA, the Serious Organised Crime Agency, though operationally independent of the Government, took the same line: "The imposition of boundaries within Internet Governance is a difficult if not futile issue. Certainly policy and process can be developed nationally or within a European framework but any regulatory control will be limited by the extent to which the offending infrastructure actually sits within such regulation. SOCA's projects are globally focused and engagement with the Council of Europe and the European Commission are important … The best solution is a global one …" (p 160).

39.  Mr Servida, an author of the Communication, gave his reasons for believing that there was a European dimension, but continued: "The real dimension is a global dimension but we think that there is no possibility for Europe as a region to cope, to work in the globalised environment of electronic communication networks and services unless there is first a kind of unified way of approaching the problem" (Q 112).

40.  At present the global initiatives that tackle security threats are mainly organised on an entirely ad hoc basis, with loose groupings of people from relevant parts of industry coming together to address particular incidents. The CERTs (and in particular CERT/CC at Carnegie Mellon University, Pennsylvania—the very first CERT to be created) often play a key role in recruiting experts to join these working groups. A recent example of this type of global initiative is the Conficker Working Group[30] who have spent the last year ensuring that the criminals who built a botnet of 7-million compromised computers (bots) have not had the chance to exploit its power. Mr Chantzos described this as "a very good example where the industry stuck together" (Q 149).

A second best?

41.  There was also a third recurrent theme. A number of witnesses, while somewhat reluctantly conceding that there was a role for the EU, saw it very much as a second best. These are only some of the views expressed:

  • "Until a worldwide strategy can be defined and agreed upon a European-centric approach should be pursued." (Phillip Ineson on behalf of Boxing Orange Ltd, p 123);
  • "In the absence of a concerted and committed global response to the issue, a European-centric policy may be the simplest and most compelling option to protect European interests." (Dr Stefan Fafinski , p 136);
  • "International companies and any enterprise with an international customer base will generally seek a global rather than a European solution. In the absence of an international response, however, a European response is a step in the right direction." (Joint ISSA-UK and BCS evidence, paragraph 3.3, p 145).

42.  We agree that the protection of the Member States and their critical infrastructures from large-scale cyber-attacks is a matter of legitimate concern to the EU.

43.  We regard the primary role of the EU as being to coordinate the activities of the Member States, spread best practices, and bring the slowest Member States up to the speed of the fastest.

44.  The national security of Member States, and the protection of critical information infrastructure as part of it, is not a matter for the EU as such.

45.  Any assessment of the role of the EU must be made in a global context, recognising that the Internet has no borders, and that many multinational companies operate both within and outside the EU.

46.  We believe that the Government and the EU should be giving greater attention to how cyber-security could be developed on a global basis. In particular, consideration needs to be given to the gradual development of international rules which will effectively discourage the launching of proxy attacks from within the jurisdiction of some of the main users of the Internet.

21   Council Directive 2008/114/EC of 8 December 2008 on the identification and designation of European critical infrastructures and the assessment of the need to improve their protection (OJ L345, 23 December 2008, p 75). Back

22   Proposal for a Directive of the Council on the identification and designation of European Critical Infrastructure and the assessment of the need to improve their protection (COM (2006) 787 final, Council Document 16933/06 of 18 December 2006), together with Commission Communication on a European Programme for Critical Infrastructure Protection (COM (2006) 786 final, Council Document 16932/06). Back

23   Directive, Article 3(3): "Priority shall be given to the ICT sector". Back

24   See paragraphs 22 to 28 on Resilience. Back

25   See paragraphs 57 et seq. Back

26   Cm 7642, June 2009. Back

27   Cm 7590, June 2009. Back

28   The two Houses of Parliament have established a Joint Committee on the National Security Strategy (JCNSS) to keep the National Security Strategy under review. The Committee met for the first time on 9 February 2010. The Committee has yet to decide whether its work should extend to consideration of the Cyber Security Strategy. Back

29   Paragraph 3.18. Back

30  Back

previous page contents next page

House of Lords home page Parliament home page House of Commons home page search page enquiries index

© Parliamentary copyright 2010