Protecting Europe against large-scale cyber-attacks - European Union Committee Contents


Resilience of the Internet

121.  We are conscious that cyber-attacks, or natural or man-made disasters, can cause acute disruption to the Internet in the short term. However we believe that the United Kingdom is reasonably well placed to cope with such disruptions. We note that it is thought to be a leader among Member States, with developed practices that set benchmarks for others to adopt. (paragraph 28)

Is there a role for the EU?

122.  We agree that the protection of the Member States and their critical infrastructures from large-scale cyber-attacks is a matter of legitimate concern to the EU. (paragraph 42)

123.  We regard the primary role of the EU as being to coordinate the activities of the Member States, spread best practices, and bring the slowest Member States up to the speed of the fastest. (paragraph 43)

124.  The national security of Member States, and the protection of critical information infrastructure as part of it, is not a matter for the EU as such. (paragraph 44)

125.  Any assessment of the role of the EU must be made in a global context, recognising that the Internet has no borders, and that many multinational companies operate both within and outside the EU. (paragraph 45)

126.  We believe that the Government and the EU should be giving greater attention to how cyber-security could be developed on a global basis. In particular, consideration needs to be given to the gradual development of international rules which will effectively discourage the launching of proxy attacks from within the jurisdiction of some of the main users of the Internet. (paragraph 46)

The Commission Communication


127.  We agree with those of our witnesses who believe that a full assessment of the value of the Communication as a whole will only be possible when we can see how it is followed up, and whether it has in fact contributed to "protecting Europe from large-scale cyber-attacks and disruptions by enhancing preparedness, security and resilience", as its title envisages. Meanwhile we share the broadly positive view of most of our witnesses. (paragraph 53)

128.  The Communication says little about the role of the EU in a global context. In any proposals for specific action, the Commission will need to pay particular attention to the way they will fit into a global framework. We believe that the more advanced Member States, the United Kingdom among them, have an influential role to play in broadening the dialogue with other principal international players, in particular the US, Russia and China. (paragraph 54)


129.  The Commission propose establishing national CERTs in all Member States. We agree that those Member States where there are too few or inadequate CERTs should be encouraged to set up national CERTs to replace or supplement them. The Government should support this proposal. (paragraph 69)

130.  None of our witnesses have suggested that the United Kingdom's current system of sector and company specific CERTs should be replaced by a national United Kingdom CERT, and we agree with them that there would be no advantage in this. The Government should explain that any suggestion that the United Kingdom and any other countries with a sophisticated CERT network should have to establish national CERTs would make no sense and would bring no added protection. (paragraph 70)

131.  We urge the Commission, when responding to our report, to clarify their intentions in this respect. (paragraph 71)


132.  We regret that United Kingdom Internet Service Providers and the rest of the commercial United Kingdom Internet industry should not have shown more interest in submitting evidence to this inquiry. This may be a reflection of their view that the Commission Communication will have little effect on them. (paragraph 76)

133.  It is clear to us that, despite good intentions, the involvement of Internet entrepreneurs in the formulation of Government policy is as yet at best superficial. Both the Government and the Commission seem to think that it is for the private sector to come forward. We think that, on the contrary, it is for the public sector to take the initiative and to offer to experienced Internet entrepreneurs a real say in how public private partnerships are best developed. (paragraph 79)


134.  The Communication mentions NATO only once. The EU and NATO should urgently develop their thinking on working together, and the Government should encourage this to happen, to achieve cooperation rather than duplication. (paragraph 85)

135.  Just as with other aspects of civil protection, there is considerable overlap between the roles of the EU and NATO in relation to cyber-attacks, and cooperation between them should be put on a more formal basis. (paragraph 86)

136.  The institutional changes introduced by the Treaty of Lisbon, and in particular the merging of the external relations responsibilities of the Commission and the Council Secretariat, should enable a more coherent approach to be taken. (paragraph 87)


137.  We hope that the United Kingdom and other Member States with a capacity for protection against cyber-attacks will shape Commission thinking as to when a pan-European exercise might be of value. An exercise involving the US might be beneficial. This points again to the need for close cooperation between the EU and NATO. (paragraph 92)


138.  We agree with the Government that the Commission's timetable for a pan-European exercise in the course of this year is unrealistic. Instead, as a first step they should encourage the majority of Member States to have carried out national resilience exercises by the end of the year. (paragraph 94)

139.  It is not only in the case of resilience exercises that our witnesses thought many of the Commission's target dates over-ambitious. We hope the Commission will accept that changes that are meticulously prepared will be more valuable than any designed only to meet artificial deadlines. (paragraph 98)

ENISA (European Network and Information Security Agency)


140.  Even if there is no extension of ENISA's mandate, we believe that consideration should be given to increasing the number of staff to enable it to perform all its tasks satisfactorily. (paragraph 105)


141.  We hope that ENISA, though not formally involved in the EU legislative process, will through its Executive Director, its Management Board and its Permanent Stakeholders Group have an important voice in the drafting of the new mandate. (paragraph 110)

142.  We hope that agreement can be reached, well before the expiry of the current mandate, on extending the work of ENISA to matters such as police and judicial cooperation over criminal use of the Internet, with a commensurate increase in resources. (paragraph 111)


143.  From the evidence we have received (though not that of the Executive Director) we are convinced that the decision to site ENISA at Heraklion was not taken on the basis of a careful cost/benefit analysis, and that it has led and continues to lead to problems over the recruitment and retention of staff, and over the scheduling of meetings. (paragraph 118)

144.  We welcome the fact that, to meet some of these problems, the government of Greece has recently made facilities available in Athens for ENISA meetings. We hope that any conference facilities which ENISA may need there will be provided so that it can function as efficiently as possible. (paragraph 119)

145.  We urge the Government to ensure that, when the question of location of EU agencies arises in the future, the Member State in which the agency is to be located should take into account the views of other Member States on the choice of site within that country, and that all such decisions should be taken only on the basis of a rigorous cost/benefit analysis. (paragraph 120)


146.  We recommend this report to the House for debate. (paragraph 6)

previous page contents next page

House of Lords home page Parliament home page House of Commons home page search page enquiries index

© Parliamentary copyright 2010