Protecting Europe against large-scale cyber-attacks - European Union Committee Contents


Sub-Committee F (Home Affairs) of the House of Lords Select Committee on the European Union is conducting an inquiry into EU policy on protecting Europe from large scale cyber-attacks.

Following on from the EU Directive 2008/114/EC "on the identification and designation of European critical infrastructures and the assessment of the need to improve their protection", in March 2009 the EU Commission published a Communication on Critical National Infrastructure Protection entitled "Protecting Europe from large scale cyber-attacks and disruptions: enhancing preparedness, security and resilience" (COM(2009)149 final, Council document 8375/09). This document was accompanied by 400+ pages of "Impact Assessment" (COM(2009)399 and 400, Council document 8375/09 ADD 1-4) setting out the background to the Commission's approach to this issue.

The Commission is concerned that an increasing number of vital services depend on digital systems, and in particular on a working Internet. Major economic or social damage could be caused if these digital systems are disrupted, either by "hacking" or "spamming" attacks, or as a result of technical failures, or as a side-effects of a natural disaster.

The Commission is especially concerned that intentional "cyber-attacks" are growing in sophistication and frequency, and that the risks that services now run are poorly understood and insufficiently analysed.

The proposal has four specific goals:

  • bridge gaps in national policies for security and resilience of critical systems;
  • enhance European governance of this area;
  • improve Europe's incidence response capability;
  • improve the resilience and stability of the Internet.

This inquiry will focus on what are the proper roles for the EU and its Member States in this important area, where many of the critical systems involved are operated by private industry and not—as was once the case for communications providers—by public bodies. The Sub-Committee welcomes evidence on all aspects of the inquiry, but in particular on the following issues:

Threat analysis

  • How vulnerable is the Internet to wide-spread technical failures? To what extent is it likely to be affected by natural disasters?
  • Are commercial companies doing enough to ensure the resilience and stability of the Internet, or is regulatory intervention unavoidable?
  • The Commission is particularly concerned about cyber-attacks, and draws attention to events in Estonia in Spring 2007 and Georgia in August 2008. Is this concern justified?
  • How concerned should be we be about criminally operated "botnets"? What evidence do we have that shows the scale of this problem, and the extent to which it can be tackled at the European level?

International responses

  • The Commission believes that a pan-European approach is needed to identify and designate European Critical Infrastructures, and that national responses will be fragmented and inefficient. Is this analysis correct? Would multi-national companies be especially in favour of multi-national policies?
  • The Commission draws attention to the emergence of "public-private partnerships" as the reference model for governance issues relating to critical infrastructure protection. However, they see no such partnerships at the European level and wish to encourage them. Are the Commission correct in this aim?
  • Are there indeed market failures occurring so that there is inadequate preparation for high impact, low probability events? And if so, how should they be addressed?
  • The Commission supports the European Information Sharing and Alert System (EISAS). Is it appropriate to develop this type of pan-European early warning and incident response capability?
  • Are Government operated Computer Emergency Response Teams (CERTs) an appropriate mechanism for dealing with Internet incidents?
  • Will the UK's existing approaches to this policy area be adversely affected by fitting in with a European-wide system—or will this lead to improvements?
  • Is it sensible to develop European-centric approaches at all, or should there be much more emphasis on a worldwide approach? In particular, are US policies consistent with the proposed European approach to the problem?

European Network and Information Security Agency (ENISA)

  • The Commission see a major role for ENISA in developing national CERTs, and in assessing the development and deployment of EISAS. Is ENISA an appropriate body for this work?
  • Is ENISA being effective in its role, or does it need reform?


  • Most of the Commission's plans are to be put into practice by the end of 2010. Is this timescale realistic?

previous page contents next page

House of Lords home page Parliament home page House of Commons home page search page enquiries index

© Parliamentary copyright 2010