EN    EN EN 
EN 1   EN  COMMISSION OF THE E UROPEAN COMMUNITIES 
Brussels, 27.10.2008 
SEC (2008) 2702 
  
COMMISSION STAFF WORKING DOCUMENT 
 
Accompanying document to the 
Proposal for a 
 
COUNCIL DECISION 
 
on a Critical Infrastructure Warni ng Information Network (CIWIN)  
 
SUMMARY OF THE IMPACT ASSESSMENT  
   
{COM(2008) 676 final} 
{SEC(2008) 2701} 
EN 2   EN On 6 June 2008, the Impact Assessment Board of the European Commission delivered an 
opinion regarding a preliminary version of this Impact Assessment report. In brief, it said that 
the report is written in a clear language, acce ssible to a non-specialis t and provides a detailed 
analysis of the possible design of the system. As regards th e main recommendations, it said 
that the text should be improve d by describing better the existing systems for alerting Member 
States and should present the benef its of the CIWIN more clearly.  
The Board further stated that: 
• The baseline scenario should be developed an d the value added of the CIWIN initiative 
highlighted. 
• The document should analyse the uptake of this initiative by the Member States.  
1. THE CIWIN  INITIATIVE  
The Critical Infrastructure Warning Informati on Network (CIWIN) initiative is part of the 
European Programme for Critical Infrastructu re Protection (EPCIP), and is concerned 
specifically with the information-sharing pr ocess between EU Member States and an 
information technology system to support this pr ocess. The establishment of CIWIN was put 
forward in the Communication on the EPCIP (COM (2006) 786 final) , which set out the 
horizontal framework for the protection of cri tical infrastructures in the EU, comprising 
measures to facilitate the implementation of EPCIP, including CIWIN.  
The creation of CIWIN has already been endorse d in the Council conclusions on “Prevention, 
Preparedness and Response to Terrorist Att acks” and the “EU Solidarity Programme on the 
Consequences of Terrorist Threats and Attacks” adopted in December 2004.1 
The main problems in the present situation are:  
• the need for a more detailed assessment of how to protect EU critical infrastructure; 
• the need for improved co-operation and exchange  of information on critical infrastructures 
between EU Member States;  
• duplication of activities; 
• insufficient trust and willingness of stakehol ders to exchange sensitive information. 
2. OBJECTIVES  
The concrete issue which requires action at EU  level is to facilitate the exchange of 
information between Member States’ authorities (e.g. on best practices), and enable them to 
use the rapid alert system on critical  infrastructure protection (CIP).  
The objective of CIWIN is to help improve CIP in  the EU and facilitate co-ordination and co-
operation for information on CIP at EU level.  
                                                 
1 14894/04 
EN 3   EN The CIWIN operational objectives are:  
• to provide an IT tool that will help those Memb er States that wish to co-operate to do so;  
• to offer an efficient and quick  alternative to often time-c onsuming methods of searching 
for information, i.e. create a type of “one-s top-system” for all relevant information on 
critical infrastructures in the EU;  
• to ensure that shared information is secure;  
• to enable Member States to communicate dire ctly and upload whatever information they 
deem relevant. 
Since some of the Member States would prefer to use only some of the functionalities that 
CIWIN offers, one of the main operational obj ectives is to identify a solution that would 
allow Member States an opt-i n/opt-out possibility on certain  aspects of the system.  
3. POLICY OPTIONS  
The Impact Assessment proposes five main policy options. 
No policy option   
Under this option no horizontal action would be taken at European level and the Member 
States would be left to addr ess the issue individually.  
CIWIN as an upgrade of existing Rapid Alert Systems (RAS)  
Under this option CIWIN would represent an u pgrade, integrating the existing RAS into a 
cross-sectoral RAS on critical infrastructure, av ailable to a broader sp ectrum of stakeholders 
than just emergency services. However, this option would not allow the exchange of generic 
information and best practices. 
CIWIN as an open platform for the (unsecure d) exchange of CIP related information  
Under this option an IT tool would be would be established and opened to the general public. 
This would undoubtedly help to raise awarene ss on CIP in Europe and increase direct 
information exchange among the stakeholders.  
CIWIN as a secure voluntary/opt-in multi-level communication/alert system composed of two 
distinct functions: a rapi d alert system and an electronic forum for the exchange of CIP ideas 
and best practices  
Under this option, CIWIN would be established as an IT tool equipped to contain and transmit 
sensitive information, classified up to the leve l of UE RESTREINT. The system would have 
two main functions: (1) a secure forum for the exchange of information, with strong emphasis 
on the exchange of best practices, dialogue and the building of trust at  EU level; (2) a rapid 
alert system for critical infrastructure. Member States would be free to use the entire system, 
to choose between the functions offered, or not to use the system at all.  
EN 4   EN CIWIN as a compulsory multi-level communication/ alert system with two distinct functions: 
a rapid alert system and an elec tronic forum for the exchange of CIP ideas and best practices  
Under this option, CIWIN would be a compulso ry system, where each Member State would 
be obliged to upload and update the relevant information regularly.  
4. BENEFITS AND DRAWBACKS OF THE POLICY OPTIONS  
Policy options Advantages Drawbacks 
Option 1: no policy change No additional legislative 
proposal; 
Member States remain 
completely free to address CIP issues as they see fit The dialogue and 
information sharing between Member States would remain the same. 
There would be no 
coherent, secure and efficient IT system for exchanging CIP information in Europe. 
No impact on improving 
EU security.  
No assurances that all 
relevant stakeholders in Europe have access to relevant CIP information.  
Option 2: upgrade of existing RAS A cross-sectoral RAS 
would be established. High cost of ensuring the 
inter-operability of existing RAS. 
The option would not allow 
the exchange of information and best practices. A new platform for the exchange of information would have to be established anyway. 
Option 3: open platform for the (unsecured) exchange of information Wide access to CIP 
information. 
The private sector would be 
able to contribute to the platform directly. 
While the information 
included in the system is already publicly available, CIWIN would offer efficient, co-ordinated and easy access to it. The information included in 
the system will be limited to non classified information only. As such information is already available, the added value of such option is limited. 
No possibilities to exchange 
alerts. 
Option 4: secure and opt-in The system would offer a The stakeholders from the 
EN 5   EN multi-level system  secure environment for the 
exchange of information and contribute significantly to building trust among stakeholders. 
The information included 
will go beyond what is already publicly available. 
The system would enable 
alerts to be exchanged. 
CIWIN would offer an 
efficient, easy to use IT system. 
CIWIN would contribute to 
increasing security in the EU. 
CIWIN would help 
overcoming the fragmentation of CIP research efforts in through better co-ordination and co-operation. private sector would not 
have direct access to CIWIN.  
The success of the system 
will depend on the Member States’ willingness to use it.  
Option 5: secure and compulsory multi-level system All Member States would 
participate in the system. 
The information included 
will go beyond what is already publicly available. 
The system would enable 
alerts to be exchanged. 
CIWIN would offer an 
efficient, easy to use IT system. 
CIWIN would contribute to 
increasing security in the EU. 
CIWIN would help 
overcoming the fragmentation of CIP research efforts in through better co-ordination and co-operation. Member States would not 
support the proposal. 
A system of obligations 
might not contribute to trust building and would backfire. 
The system might run 
counter to the principle of proportionality. 
 
EN 6   EN 5. PREFERRED OPTION  
After analysing the five options, Option 4 — CI WIN as a secure volunta ry/opt-in multi-level 
communication/alert system composed of two dis tinct functions: a rapid alert system and an 
electronic forum for the exchange of CIP ideas and best practices — clearly showed the most 
advantageous ratio between benefits and drawbacks.  
It has to be stressed that CIWIN will not revo lutionise EU security, a nd needs to be regarded 
as only one of many steps towards implementing th e EPCIP. CIWIN is an IT tool designed to 
facilitate communication around CIP topics and provides such functions as news bulletin 
boards, discussion groups, collaborative enviro nments, document and workflow management 
features that are part of everyday internet or corporate intranet experience. Work on the 
CIWIN will consider a large number of features , while ensuring that their existence and use 
can be suppressed in situations where they ar e not seen to add any value or where they 
conflict with established practices.