1.1........ Introduction.. 4

1.2........ Consultation and expertise.. 5

2........... Context.. 7

3........... Problem definition.. 8

3.1........ Market overview... 8

3.1.1..... Overview on the scope of the analysis. 8

3.1.2..... Relative market size and employment figures. 9

3.1.3..... Distinctive features of the security market.. 10

3.1.4..... Competitiveness of the EU security industry.. 12

3.2........ The main problems of the security sector in the EU and their drivers 18

3.2.1..... The fragmentation of the EU security markets. 18

3.2.2..... The gap between research and market.. 24

3.2.3..... The uncertainty of societal acceptance for security technologies 27

4........... The current Situation.. 31

4.1........ Market fragmentation.. 31

4.2........ Gap between research and market.. 32

4.3........ Integration of the societal dimension into industrial policy 33

5........... EU right to act.. 33

6........... Objectives. 35

7........... Envisaged policy initiatives. 36

7.1........ Market fragmentation.. 36

7.2........ The gap between research and market.. 40

7.3........ The integration of the societal dimension.. 40

7.4........ Overview of the envisaged policy initiatives. 41

8........... The Expected benefits of the envisaged policy initiatives. 42

8.1........ Market fragmentation.. 42

8.2........ Gap from research to market.. 44

8.3........ Societal aspects. 46

List of Acronyms. 47

Annexes. 49

Annex 1: Summaries of the Workshops. 49

Annex 2: Results of the Public Consultation on an Industrial Policy for the Security Industry.. 52

Annex 3: Sectors of the Security Industry.. 73

Annex 4: Structure of the Problem Definition.. 75

Annex 5: Overview of the most important challenges to the internal security of citizens among the EU 27. 76

Annex 6: Definition of Pre-Commercial Procurement.. 77

Annex 7: Competitiveness Proofing – Two illustrative cases. 79

Annex 8: Background to quantitative analysis of certification.. 98

Annex 9: Background to quantitative analysis of PCP. 103

Annex 10: Background to quantitative analysis of Civ-Mil Synergies 106

Annex 11: Initial list of EU wide standards for security.. 109

General Annexes: 115

1.1. Introduction

Security is unmistakably one of the central concerns of any society. A safe and secure environment is the very basis on which any stable society is founded upon. Citizens need to be free of security related preoccupations if they want to live their lives freely and contribute to the well being of our society.

Our societies become ever more dependent on technologies, foreign supplies of energy and raw materials. The constant technological evolution of our society had countless benefits for our daily lives, but the growing performances of our energy, transport and communication networks has also led to an ever increasing technological dependency[1].

A vivid example of the consequences of a terrorist attack were of course the losses in the aftermath of the 9/11 attacks, which did not only lead to the death of over 3000 people but also had a dramatic effect on the worldwide economy. It is estimated that 9/11 caused losses in US productivity amounting to US$ 35 billion, 47 billion in total output and a rise in unemployment by almost 1% in the following quarter.[2]

Open data puts the direct cost of crime, terrorism, illegal activities, violence and disasters in Europe at EUR 650 billion / year (excluding bribery, corruption and money laundering) or about 5% of the EU 27 GDP (~billion 12.000 EUR in 2010).[3] At the same time we see an increase of natural disasters requiring crisis management technologies.[4]

The threats to which our society is confronted are permanently evolving, terrorist and criminals will always look for loopholes in our technologies and try to bypass our security systems. We need to be aware of the fact that no technology will ever guarantee a 100% security, but at the same time, no security concept is thinkable without the adequate technologies. A competitive EU security industry is the conditio sine qua non of any viable European security policy and for economic growth in general.

Many EU security companies are still among the world leaders in most of the segments of the security sector, thanks to their level of technological development and their high quality manufacturing. Recent forecasts, based on market developments, studies and industry predictions do however indicate that the market shares of European companies on the global market are bound to decrease constantly over the next years.[5]

On the one hand, many US companies are still the technological front runners, they additionally also benefit from a harmonised legal framework and a robust internal market. This gives them not only a reassuring basis but also the benefit of a clearly recognised and distinguishable US brand, which proved to be a highly valuable advantage compared to EU companies in terms of international competition.

On the other hand, the Asian countries such as China are closing the technological gap that separates them from EU companies at an alarming rate. Without a technological advantage, the EU companies will be confronted with a nearly insurmountable competition, as the discrepancy in terms of production costs is largely disadvantageous for EU companies.

Industry and market forecast studies predict that the current market share of EU companies in the security sector could drop from roughly 25% in 2010 of the world market to 20% in 2020, if no action is launched to enhance the competitiveness of the EU security industry.[6]

In response to these challenges, the Commission made the security industry one of the essential parts of the EU 2020 flagship initiative "An Industrial Policy for the Globalisation Era Putting Competitiveness and Sustainability at Centre Stage ".[7] Therein the Commission announced to launch a dedicated initiative on a Security Industry Policy.

This Commission Services Staff Working Document is the result of a dedicated analysis by the services of DG ENTR on possible areas and measures where the EU could launch policy initiatives in support of the EU security industry. It should be noted that this Document will not be followed by any legislative proposal.

Any possible future legislative policy measure on the Security Industry will be preceded by a dedicated Impact Assessment as well as thorough stakeholder consultations.

1.2. Consultation and expertise

External expertise

In the context of this analysis, three different studies were commissioned to an external contractor[8]:

· Competitiveness of the EU Security Industry;

· Regulatory Framework and Certification/Conformity Assessment Procedures in the Security Sector (referred to as SECERCA study in the footnotes); and

· Pre-commercial Procurement in the field of Security.

A further study on the civil-military synergies in the field of security is currently in its final stages.[9] In addition, a previous study undertaken by DG ENTR on "Industrial implications in Europe of the blurring of the dividing lines between Security and Defence"[10] was also used.

A highly valuable contribution in the understanding of these issues is the work of the FP7 (7th Framework Programme, a list of acronyms used in this report is contained in the annexes) research project EUSECON (A New Agenda for European Security Economics)[11]. This project analyses the economic and social costs of terrorist attacks and anti-terror policies.

Stakeholder Consultation

A number of stakeholders were consulted throughout the analytical process, through both public and targeted processes.

An online public consultation was held from the 14th of March until the 15th of May 2011. The Commission received in total 59 responses to this public consultation. It should be underlined that despite the relatively low number of participants, all the relevant actors and stakeholders of the security sector participated. Contributions were received from stakeholders in 13 countries (one additional participant did not specify his country of origin), including 2 EFTA countries. The respondent's background was spread over the following areas: large enterprises 32%, business associations 22%, SME's 19%, national administrations 7% and NGO's 7%. The results of the public consultation can be found throughout this Staff Working Document and under the Annex 2 "Results of the Public Consultation".[12]

A series of targeted consultations were also held in the context of conferences and public/private debates.

· On 9 February 2011, a "High Level Public-Private Security Roundtable" was organised by the main European business association for security companies, the European Organisation for Security (EOS) together with the Commission.[13]

· A further consultation took place on the 23rd of May, the "High Level Conference Defence and Security Industries and Markets" which was organised by VP Tajani and Commissioner Barnier.[14]

· On 29 September 2011 a Workshop was organised with CEN, CENELEC and ETSI on standardisation in the security area. A summary can be found in Annex 1.

· On 14 October 2011 a Conference on "Competitiveness through Standardisation" was held in Brussels. One of the round tables addressed "Standards as a tool for security industrial policy", the results of which can be found in Annex 1.

· On 18 October 2011 a Workshop on "Security Industrial Policy" was held in Brussels, the results of which can be found in Annex 1.

· On 21 March 2012, the second "High Level Public-Private Security Roundtable" was organised by the main European business association for security companies, the European Organisation for Security (EOS) together with the Commission.[15]

The results of the consultation were fully supportive regarding the initiative of the Commission. The main aspects of the problem definition were fully supported by a large majority of the stakeholders, both from the public and the private sector (i.e. by ~ 80% of the respondents of the public consultation). The need for the EU to launch dedicated policy initiatives to strengthen the EU security industry was also widely acknowledged (i.e. by 87% of the respondents of the public consultation).

The minimum standards of the Commission for consultations have all been met.

2. Context

Security as a national prerogative

The underlying problem faced by the EU security industry is that security policy is still very much a national prerogative, where Member States delegate a limited amount of authority to supra-national entities.

This is emphasized even further by the diverging threat perceptions and assessments in the EU Member States. Each Member State has its own specific cultural and geopolitical background which directly influences its security priorities. Some countries have to deal more often with natural disasters like earthquakes or large forest fires, while others have repeatedly been the victims of terrorist attacks.

However, the EU has already found ways to overcome this problem, for example in the area of airport security, where whilst it is left up to Member States to use certain screening equipment or not, if they use it they have to follow performance requirements set by the EU.

The issue of diverging threat assessments among the Member States has already been addressed by the Commission Communication: "The EU Internal Security Strategy in Action: Five steps towards a more secure Europe", which called for a common all-hazards approach to threat and risk assessment: "The EU should establish by 2014 a coherent risk management policy, linking threat and risk assessment to decision making."[16]

Policy developments

So far, the main initiative addressing the issue of security industrial policy in the EU has been the “European Security Research and Innovation Forum (ESRIF)”.[17] Between 2008 and 2009 more than 600 experts on security worked on an extensive analysis of the EU security sector, in particular regarding the medium and long-term challenges that Europe faces.

The final report of ESRIF was adopted on 23rd November 2009[18], providing a list of key messages, recommendations and an extensive list of security research topics for the EU over the next 20 years, called the “European Security Research and Innovation Agenda”. The work of ESRIF provided the EU policy makers with a knowledge base for the measures to enhance the security of its citizens.[19]

The Commission subsequently published on 21 December 2009 a Communication setting out the Commissions' initial position on ESRIF's key findings and recommendations[20] The Communication emphasised for the first time the need for an industrial policy for the security sector.

3. Problem definition

3.1. Market overview

3.1.1. Overview on the scope of the analysis

Defining the exact scope of the security industry is a difficult task:

Firstly, the security industry is not covered as such by the main statistical nomenclatures (NACE, Prodcom, etc.). The production of security-related items is hidden under a wide range of industry and services headings. Statistics for these headings don't distinguish between security and non-security related activities.

Secondly, ‘security’ is not a stable concept. It varies with changes in the perception of new threats. The scope of the security industry changed after 9/11, to encompass new anti-terror activities; more recently cyber-crime came to the forefront.

Thirdly, from a supply-side perspective, procurers of security equipment and systems can be reluctant to provide information on security expenditures.

The definition of security industry used in the context of this Staff Working Document is the result of a cross-analysis of the most commonly used typologies of the security industry (i.e. the scope used by previous studies on the security industry (inside and outside of the EU), the scope of the FP7 Security Theme as well as the scope of the US Department of Homeland Security (DHS)). This resulted in the categorisation of the 2009 Commission study on the "Competitiveness of the EU security industry".[21]

The EU security industry can broadly be subdivided into the following sectors:

· aviation security;

· maritime security;

· border security;

· critical infrastructure protection;

· counter-terror intelligence (including communication);

· physical security protection; and

· protective clothing.

A list of illustrative examples for the different sectors encompassed in the security industry can be found in Annex 3.

3.1.2. Relative market size and employment figures

In the table below are some more details on the relative market size of the different sectors.

Table 1: Relative market size of the global and European security industry markets (indicative € estimates by sector) [22]

SECURITY INDUSTRY

Sectors || EU security market (low estimate) || EU security market (high estimate) || Global security market estimate

Aviation security || € 1.5 bn || € 2.5 bn || € 5.2 bn

Maritime security || € 1.5 bn || € 2.5 bn || € 6.7 bn

Border security || € 4.5 bn || € 5.5 bn || € 9.9 bn

Critical infrastructure protection || € 2.5 bn || € 3.5 bn || € 12.6 bn

Counter-terror intelligence || € 4.5 bn || € 5 bn || € 19.4 bn

Physical security protection* || € 10 bn || € 15 bn || € 39.2 bn

Protective clothing (first responders) || €1.5 bn || € 2.5 bn || €10 bn

TOTAL MARKET SIZE || € 26bn || € 36.5 bn || € 103 bn

* It includes CCTV, access control equipment, intrusion and detection systems, etc.

Source: ECORYS (2009)

The physical security protection, a traditional security market based on general security applications such as closed circuit TV (CCTV), access control, intrusion and fire detection, counts for nearly 40% of the total European market, with a market value ranging from €10bn to €15bn.[23] Border security as well as counter-terror intelligence are both estimated to, at least, represent €4.5bn of the European security market, while critical infrastructure protection has a market value within a €2.5bn to €3.5bn interval. Last but not least, the aviation and maritime security sectors are both estimated to have a market value ranging from €1.5bn to €2.5bn.[24] The tables in the general annex (tables 7 and 8) give a more detailed view on the strengths and weaknesses of the EU security industry in the most relevant areas (Overview of market characteristics for specific equipment segments and SWOT analysis of the European Security Industry).

The global security market is worth some €100bn (2008 figure) with around 2 million persons employed worldwide in the security industry. The European security market has an estimated market value in the range of €26bn to €36.5bn (2008 figure).[25][26]

From a global perspective, North America (mainly the US) is the largest security market, with a current market share of around 40% or more. Europe is ranked 2nd in the global security market, with a market share ranging approximately from 25% to 35%. Despite the financial crisis, global demand for security equipment is expected to grow at a minimum of around 5% per annum, with the fastest growth in coming years expected to be mainly in Asia and the Middle-East.[27]

As regards employment in the security industry, it is estimated that around 180,000 persons work in the EU in the security industry (2011 figure). This figure includes 130,000 working directly for the security industry and another 50,0000 induced or secondary markets (i.e. subcontractors).[28]

3.1.3. Distinctive features of the security market

The EU security market consists of products/technologies and services. As present studies and stakeholder opinions have shown the main pressure of global competition will lie on the products/technologies sector as those form the vast majority of contemporary and potential future security related exports. The main question for security service providers will rather be whether they would still have access to EU made products/technologies in the future to foster and maintain the quality of their business or whether they would have to acquire these from the EU’s competitors.

The security market has three distinctive features which differentiates it from the majority of the other industrial sectors. That is not to say that these features are not also common to other markets, they are however especially pronounced in the security markets, which is largely due to the national sensitivities on security matters.

(1) Fragmentation of the market along national or even regional boundaries: Security, being one of the most sensitive policy fields, is one of the areas where Member States are hesitant to give up on their national prerogatives[29]. This means in concrete terms:

Higher barriers to entry than in other sectors, in particular:

· higher investment costs associated with technology development and, also, with the transition from technology development to placing a product on the market. This is even more aggravated by the fact that in the security area there is often an asymmetric level of knowledge between the demand side and the supply side, thus making it difficult to bring research results quickly to the market.

· higher costs associated with securing markets (e.g. lobbying, marketing, commercial diplomacy). An important aspect to this is related to needs to ‘educate’ clients on technological possibilities and choices.

(2) Societal/ethical dimension: While security is one of the most essential human needs, it also is a highly sensitive area. Security measures and technologies often provoke the fear of a possible endangerment of privacy. Any attempt to introduce a security solution that could violate ethical values would lead to fierce societal reaction.[30][31]

(3) Institutional market: In large parts the security market is still an institutional market, i.e. the buyers are public authorities. Even in areas where it is a commercial market, the security requirements are still largely framed through legislation.

SMEs typically play only a limited role in the security market and are often restricted to highly specialised ‘niche’ segments. Where SMEs are able to successfully develop innovative technologies it is usually the case that – as a result of the high barriers to entry noted above – they tend to license this technology to larger players (e.g. dedicated equipment integrators) rather than try to enter markets independently; alternatively they may simply be acquired by such players.

The SMEs present in the security sector often have limited access to the market for larger scale public (and quasi-public) and major private security equipment and systems contracts. It appears difficult for SMEs to grow significantly.[32]

An example for this can be found in a case study financed by the Austrian Ministry for Transport, Innovation and Technology (bmvit).[33] Whilst the average increase of turnover between 2007 to 2009 for companies active in the sector of critical infrastructure protection (as one “core-group” of the security industry) was at 19.2 %, the turnover for the 15 largest companies increased by 32.2%.

3.1.4. Competitiveness of the EU security industry

The estimations on the general market evolutions detailed in this analysis are based on the results of the four studies launched by the Commission services as well as on industry forecasts.

The Commission services will, in order to remedy this lack of data, develop an empirical basis on which more reliable figures on the security markets could be established. Cooperation with EUROSTAT as well as the main trade associations is essential to such an undertaking. The 2009 study on the competitiveness of the EU security industry could serve as an initial starting point for such an analysis.

The current market situation

To this date, the competitiveness of the EU industry is acceptable in a number of segments. EU companies are still among market leaders and benefit from a relative technological advantage and high quality manufacturing compared to some of the emerging countries in Asia. The forecasts made by the EU security industry on the future competitiveness of the EU security companies are however less encouraging.

The EU is not in a position of being the sole producer of certain innovative technologies nor can it sell technologies at prices below those of the US and Chinese competitors. Chinese companies are closing the technological gap that separates them from EU and US companies at an increasingly fast rate.[34] These prospects are further darkened by the reality that few if any EU company will be able to compete on an equal level with Asian companies in terms of production cost.

Illustration on burglar and fire alarms:

A concrete example for this evolution is the segment of burglar and fire alarms. EU companies are among the front runners in the world wide competition and have generated considerable benefits in terms of external trade. The recent market evolutions as well as the stakeholder consultations do however reveal a rather bleak outlook. As shown in the two tables below, the trade balance and the competitive advantage of EU companies, after having peaked in 2009, is now facing a progressive decline.

It should be noted that the alarm systems represent a highly important segment in terms of economic size, with a market size of EUR 4.5 Billion or 50% of the physical security market. A detailed analysis of the competitiveness of this industry segment can be found in the attached Annex 7 "Competitiveness proofing – two illustrative examples".

EU external trade in burglar and fire alarms: total value ($US million)

Year || Total extra-EU exports || Total extra-EU imports || Trade Balance

2002 || 217.4 || 355.6 || -138.2

2003 || 256.0 || 398.0 || -142.1

2004 || 304.0 || 453.3 || -149.3

2005 || 314.7 || 497.5 || -182.8

2006 || 378.0 || 576.5 || -198.5

2007 || 497.3 || 579.9 || -82.6

2008 || 660.1 || 608.6 || 51.5

2009 || 665.3 || 554.8 || 110.5

2010 || 599.1 || 602.0 || -2.9

(source: ECORYS 2011)

EU Revealed Competitive Advantage (RCA) index for burglar and fire alarms

(source: ECORYS 2011)

The main competitors

The main competitors of the European security companies often have a vast internal market and/or a very favourable regulatory framework.[35] The strongest player and most important competitor for the EU is the United States. The US is not only the biggest market, but US companies are often technical frontrunners in high-end security equipment.[36]

Illustration on airport screening equipment: US comparison The US represents the main competitor to the EU in the aviation security screening sector - and for the security industry in general – and is the largest single market for aviation security equipment and systems. In terms of factors shaping the business environment for suppliers of aviation security screening equipment and systems, two features of the US situation are of particular relevance: · A single Federal authority – the Transport Security Administration (TSA) – is responsible for setting the approach to aviation security and technology adoption, for determining performance requirements, for evaluating and approving security equipment and, finally, for the procurement and deployment of equipment. · The SAFETY Act provides for the reduction of liability risks for manufacturers and distributors of anti-terrorism technologies. Further DHS designation and certification[37] under the Act provides de facto approval of security equipment and technologies that is recognised in global markets. Compared to the present EU situation, the US market is characterised by: · Lower costs of supplying the market, both in terms of the costs associated with compliance (conformity assessment) and approval (certification) of equipment and systems, and more generally for securing markets. · Lower uncertainty over the potential market size for new security products and technologies; there is a single US position on the utilisation of technologies and performance standards/requirements. · Lower risk attached to investments in research, technology development and innovation activities, both because of more certain market potential and liability situation. · Shorter ‘time to market’ for new security technologies and innovations. A detailed analysis of the competitiveness of this industry segment can be found in the attached Annex 7 "Competitiveness proofing – two illustrative examples".

Israeli and Japanese companies have a strong position in high-end security equipment, but mainly cover specific niches such as IT and communication security. The Chinese and Russian markets show strong growth rates in the traditional physical security protection segment (CCTV, access control). However, Chinese and Russian companies produce mainly low-end security equipment and do not yet compete with the high-end oriented EU companies.[38]

China

General overview

The US Commercial Service estimated that the Chinese safety and security market generated a turnover of €13.5 billion ($17 billion) in 2006. Another source estimated the turnover of the security market (without surveillance) to be €27 billion ($34 billion) in 2006. Given the relatively high growth rates of the Chinese economy (despite the 2008/2009 economic crisis) the growth expectations for the safety and security market are high. The US Commercial Service expected (in 2008) a turnover of €22.7 billion ($28.5 billion) in 2010.

The main drivers for demand are China’s growing economy and massive construction projects (especially in the Eastern coastal area), as well as demand from the public authorities. The US Commercial Service reports that sophisticated surveillance equipment (mainly for monitoring and controlling access) is widely used in high-end residential areas and commercial office buildings. The 9/11 attacks lead to a stronger awareness for security protection. The government strengthened their anti-terrorism measures (especially in relation to air security) and surveillance and monitoring equipment is widely used in seaports, railways and airports (protecting cross-border shipments of goods and passengers).

Main fields of activity

Three main fields of activity can be identified within the Chinese safety and security market, which are video surveillance, door access, and burglar-proof alarm equipment.

The (members of the) China Security and Protection Industry Association (CSPIA) covers also other types of security equipment, like biometrics, IT security, cash in transit, critical infrastructure protection, physical/barrier protection and transport and aviation security.

Japan

General overview

Currently, security is an important public concern in Japan and the size of the security industry is growing fast. In its analysis of the Japanese security industry, the US commercial Service indicates that this public concern is related to very high crime rates (mainly related to burglary), but also credit card and e-mail scams and identity theft. The size of the total Japanese security industry (including both the sales and installation of security equipment and security services) is estimated at a projected size of 4.6 billion ($5.7 billion) in 2010.

Main fields of activities

Five main segments can be identified within the security equipment market. Image/monitoring and access control were the leading markets in 2005 while image/monitoring equipment as well as sensors are the main expected growth segments. The US Commercial Service observes that school and town security (emergency alert systems) and also regional safety (mass notification systems) are emerging sub-segments (with a projected size in 2008 of €78 million).

Israel

General overview

Given the unstable political situation in the Middle-East and direct terrorist threats, security is a top priority in Israel. Both the defence and homeland security (HLS) industry are seen as a fundamental part of the national security of Israel. At the same time, HLS knowledge and experience is more and more seen as an interesting export product.

Several (government related) websites promote the Israeli HLS sector as an important trade and investment opportunity for foreign countries. The Investment Promotion Center (IPC, part of the Ministry of Industry, Trade and Labor), for example, identifies HLS & Public Safety as one of the main business sectors for investment, stating that ‘Israel has earned a worldwide reputation for providing leading security solutions’.

The annual HLS industry turnover (2008) is approximately €2.7 billion ($4 billion). Approximately 25% of that turnover is related to export of security products. It is assumed that the HLS (including surveillance, see below) is comparable to the turnover of the Israeli military and defence industry (€4 billion / $5 billion in 2006). Employment within the HLS industry is estimated at 25,000 people, being therefore slightly smaller than the military and defence industry (35,000 employees).

Main fields of activity

The HLS industry covers a whole range of security areas. The Israel Export & International Cooperation Institute (IEICE) identifies twelve main areas such as access control, commodity protection, identification / authentication, IT security & software, perimeter protection and tracking and motion detection; while the IPC also stresses aviation, maritime & transportation security, counter terrorism, CBRN and critical infrastructure protection.

Russia

General overview

The estimated value of the total Russian security market (including security services and equipment) was approximately €4.5 billion ($5.6 billion) in 2006. Approximately 20% of this total relates to the security equipment market (€1.1 billion in 2006). The rest of the security market is mainly related to security services (guarding services and physical protection). The Russian market shows high annual growth rates.

Main fields of activity

Within the safety and security equipment market, four key segments can be identified, namely CCTV & video surveillance, security & fire alarm, intruder alarm & perimeter protection, and access control. The CCTV segment is seen as the most developed and competitive sector. For the coming years, the CCTV and access control systems are the most promising segments in terms of growth expectations.

A crucial competitive advantage that mainly concerns US companies is the benefit of a large home market. Having a harmonised market of over 310 million inhabitant's guarantees US companies access to a stable and reliable market, which in turn allows them to gain a critical mass and increases their competitiveness in terms of price and costs. The large and well known US market also gives these companies the advantage of "brand recognition".

For example, a large number of different standards and certification procedures exist in the EU alone for airport screening equipment. The US has only one. US companies can state for instance that their airport scanners are used in hundreds of airports in a country of over 300 million inhabitants. US manufacturers thus have a better and clearer reputation on a global scale than an EU manufacturer that can only refer to his comparatively small market.

This lack of a similar "EU brand" is especially critical if one considers that the central future markets for security technologies will not be in the Western Hemisphere but in emerging countries in Asia and the Middle East. To cite just some examples: China plans to build 80 new Airports by 2020, many major sports events (which are typically huge markets for security technologies) will take place in Asia such as the 2018 Winter Olympics in Pyeongchang (South Korea) and the 2022 FIFA World Cup in Qatar.

Stakeholder contribution on this issue, taken from the Public Consultation

"An EU-wide accepted certification scheme with one unique label (e.g. CertAlarm -> www.certalarm.org) in all Member States with the withdrawal of all national marks would allow the European security industry to present a united front on the global market."

3.2. The main problems of the security sector in the EU and their drivers[39]

The main problems of the EU security industry are the highly fragmented nature of the EU security markets, the difficulty in closing the gap between research and market and the uncertainty of societal acceptance for security technologies.

3.2.1. The fragmentation of the EU security markets

The main challenge the European security industry faces today is the highly fragmented nature of the EU security market. Divergent approaches have effectively led to the creation of 27 different security markets. This situation is not only an anachronistic rarity in the European Union, it has also several negative consequences both for the supply and the demand side:

Supply side:

· Commonly existing high barriers to market entry are considerably aggravated, particularly at the ‘high-end’ of the ‘new’ security market[40]. Instead of having just one central market to address to, the security companies have to multiply their efforts associated with securing markets by 27, which considerably raises the investment and commercialisation costs of security technologies[41]. These disproportionate burdens often discourage the security industry (and SMEs in particular) to go beyond their national borders[42].

· True economies of scale can therefore not be realised which aggravates further the fragmentation of the market and weakens the competitiveness of the security industrial base. This fragmentation forced industry in some cases to foresee different product configurations for different target markets.

Demand side:

· National orientation of the security companies leads to a lack of competition among suppliers and users of security products are therefore not always able to buy the best security products at the lowest price.

· Eventually the demand side is forced to purchase a less controversial product which does however not entirely fulfil the technological requirements. In the end the demand-side has to opt for products that do not necessarily meet the initial technical requirements

Stakeholder contribution on this issue from a business association taken from the public consultation:

"Market fragmentation and the absence of a real European market results in high cost structures and therefore high costs for the Society. Within a harmonised market larger quantities could lead to better cost recovery in procurement and sales."

It should be noted that the level of fragmentation of the EU security markets is not equal to the usual fragmentation that can be found across other industrial sectors in Europe. Almost every industrial sector is characterised by some degree of fragmentation, the large majority does however have at least some common denominators, be it EU wide standards, harmonised certification systems or procedures of mutual recognition.

Producers of airport screening equipment are, for instance, faced with over 15 different certification procedures. This means that a producer of such technologies has to modify his product, in some cases substantially, if he wants to access new markets. This high degree of fragmentation has subsequently prohibited the creation of an internal market for security technologies. The only sector where a similar level of fragmentation can be found is the defence sector.

This particularity of the EU defence and security markets had been clearly laid out in the Impact Assessment that accompanied the proposal for Directive 2009/81/EC on the coordination of procedures for the award of certain works contracts, supply contracts and service contracts by contracting authorities or entities in the fields of defence and security.[43]

This negative effect of the fragmentation on the EU security markets was also unambiguously underlined in the above mentioned Commission Communication "A European Security Research and Innovation Agenda - Commission's initial position on ESRIF's key findings and recommendations": "The security industry in Europe needs to become more competitive and efficient. Up to now the industry suffered from the fragmentation of the markets that lead them to be nationally or even regionally oriented."[44]

The specificity of the high degree of fragmentation of the Security Industry has also been acknowledged and criticised throughout the stakeholder consultations organised by the Commission services.

Stakeholder contribution on this issue from a Member State taken from the public consultation:

"La sécurité : un secteur à part entière

Trop souvent associé à d’autres domaines connexes, le secteur de la sécurité se distingue pourtant de ceux-ci à de nombreux égards. Il est ainsi caractérisé par :

Une fragmentation importante de l’offre

[…]

Une fragmentation plus importante encore de la demande

Admis depuis déjà de nombreuses années, ce constat ne semble malheureusement pas s’améliorer. Ainsi, la demande est toujours caractérisée par d’une part des utilisateurs finaux publics (police, gendarmerie, sécurité civile, pompiers…) très éclatés qui se répartissent sur différents niveaux, du local jusqu’au national, et à travers de multiples services opérationnels. De l’autre, s’ajoute également les opérateurs qui représentent une part importante, voir peut-être majoritaire de la demande, et pour lesquels, trop souvent, la sécurité représente un investissement supplémentaire ainsi qu’une charge additionnelle sur ses opérations.

Cette fragmentation est encore accentuée au niveau européen par la forte disparité des législations nationales et des sensibilités vis-à-vis des libertés et droits individuels qui rendent encore plus difficile la constitution d’une demande plus homogène à travers l’Europe.

Ainsi, force est de constater que le marché intérieur reste encore qu’un concept vague et loin d’être réalisé dans le secteur de la sécurité."

Underlying drivers of the market fragmentation

Nearly each EU Member State has different regulations on performance standards[45] and certification systems/conformity assessment[46]:

(1) The absence of clearly defined EU wide performance standards introduces uncertainties for equipment providers in relation to the expectations of customers regarding required performance and, in turn, for determining investments in technology/product development[47].

EU illustrative example:

Illustration: Secure Communications among police forces

A very concrete example for the lack of EU wide performance standards is the issue of secure cross border communication among police forces in the EU. Currently two different communication systems exist: "TETRA" and "TETRA-POL". The lack of interoperability between the two systems leads to severe communication problems between police forces of adjacent Member States such as Portugal and Spain. In the case of the BENELUX countries cross border communication is still gravely hindered, even though the three countries all use the TETRA-POL standard, because of a lack of interoperability between the technologies of two different producers. This situation has led to a series of cross border incidents, which in turn initiated a number of FP7 security research projects.[48]

The participants to the Public Consultation, independently form their background also largely supported this assessment.

Responses to the question: Do you agree that the lack of EU wide standards for security affects the market fragmentation?

Respondent profile || Do not agree at all || Do not agree || Agree || Agree very much || Do not know

A business association || 1 || 2 || || 9 || 1

A national administration || || || 2 || 2 ||

An academic institution or think tank || || || 2 || 1 ||

An individual || || || || 1 ||

Large enterprise (more than 250 employees) || || 2 || 2 || 14 || 1

Medium enterprise (between 50 and 249 employees, turnover less than €50 million) || || 1 || 1 || 3 ||

Micro or small enterprise (fewer than 49 employees, turnover less than €10 million) || || 1 || || 5 ||

Non governmental organisation || || || || 1 || 3

Other || || || || 3 ||

Regional or local administration || || || || 1 ||

Grand Total || 1 || 6 || 7 || 40 || 5

(2) The absence of EU wide certification systems: No common system of certification exists at a European level for security equipment and there is no mechanism of mutual recognition across countries[49]. A producer of security technologies has to go through the costly and lengthy certification processes for each and every country in which he wants to commercialise his technologies.[50]

EU illustrative examples:

Illustration: Conformity assessment and certification of screening equipment

An industry source has indicated, for example, that the cost of a single test of an Explosive Detection System (EDS) could be in the region of €65 thousand and for a liquid explosive system (LAGS) the figure may vary from €30 to €75 thousand; these figures relate to a single test procedure and do not take into account any repeat testing that may be required. The aforementioned products are relatively small systems and costs associated for larger systems are reputed to be significantly higher and may run into several hundred thousand Euros; for example, an amount of €100 thousand has been indicated for an ‘imaging test’ for a cargo scanner while a figure of €500 thousand has been indicated for the cost of the certification process for a biometric identity card model.[51]

Illustration: Conformity assessment and certification of alarm systems

Currently a producer of a security alarm system seeking to supply their product throughout the EU will typically need to apply for 10-15 certificates from different Member States. The costs of certification of an alarm system are on average (with a large spread depending on the nature of the product) at the level of EUR 200-300 thousand for full access to Europe including all tests. Stakeholders indicate that the estimated cost for obtaining a mutually recognised certificate for the same alarm system would amount to EUR 40-60k.

The negative effect of the lack of harmonised certification/conformity assessment procedures for security technologies on the market fragmentation was also widely acknowledged by all the participants of the public consultation, be they from national administrations, business associations, large enterprises or SME's. On the question "Do you agree that the lack of harmonised certification/conformity assessment procedures for security technologies affects the market fragmentation" 80% of the participants agreed and only 5% disagreed.[52] More detailed information on the responses to this question can be found in the table below.

Responses to the question: "Do you agree that the lack of harmonised certification/conformity assessment procedures for security technologies affects the market fragmentation?"

Respondent profile || Do not agree at all || Do not agree || Agree || Agree very much || Do not know

A business association || || || 4 || 6 || 3

A national administration || || || 3 || 1 ||

An academic institution or think tank || || || 1 || 2 ||

An individual || || || || 1 ||

Large enterprise (more than 250 employees) || || 2 || 2 || 14 || 1

Medium enterprise (between 50 and 249 employees, turnover less than €50 million) || || || 2 || 3 ||

Micro or small enterprise (fewer than 49 employees, turnover less than €10 million) || || 1 || 1 || 4 ||

Non governmental organisation || || || 1 || || 3

Other || || || 1 || 2 ||

Regional or local administration || || || || || 1

Grand Total || 0 || 3 || 15 || 33 || 8

(3) Delays in certification procedures: the slow speed of the certification process can mean that technologies are already outdated before they receive approval [53].

EU illustrative example:

Illustration: X-Ray Scanners

A French company, which is specialised in neutron generators and analysers, developed a detector that was complementary to conventional X-ray tomography for detecting explosives in baggage. However, in France the transposition into the public health code of Euratom Directive 96/29 greatly widened its scope, going beyond the maximum activation threshold of the Directive. In practice it prohibits any "activation" of consumer goods or food products, whatever the intensity. Because of this, the newly developed technology could not be used or tested in France, because all hold or cabin baggage may contain consumer goods or food products.

The absence of an EU wide certification system for security technologies has the following consequences on the EU security industry sector.

Consequences of the current situation on certification procedures in the EU:[54]

Market conditions || Producers || Procurers/ users

 A lack of transparency on product performance ||  Costs of complying with multiple national procedures; ||  Lack of transparency

 Market fragmentation ||  Delay in ‘time to market’ of products; ||  Limited choice of suppliers

 Adaptation costs to meet national conformity assessment and certification procedures and standards;

 Slow development and diffusion of new security technologies and solutions.

3.2.2. The gap between research and market

For the EU security industry it is very often difficult to close the gap from research to market. In other words, when doing R&D on new technologies, it is often very difficult for industry to predict whether there will be in the end a market uptake, or to get some sort of guarantee that there will be a market. While this is a widely spread problem across many industrial sectors, it is an especially pronounced issue for the security industry. This is in particular due to the fact that the security market is very often an institutional market.[55] And this institutional market is mostly driven by catastrophic events/crises, as well as regulatory frameworks that set out security requirements.

The problem is aggravated by the fact that those that set the security requirements are most often not the same entities that provide R&D funding and which are again different from the procurement agencies[56].

Supply side:

For the supply side this often means that some of its R&D investment is simply wasted, as there is no subsequent market uptake. Given that it is mostly an institutional market, it is not really possible to divert this investment into other market segments.

It also means that companies often simply do not explore new, potentially promising R&D concepts, or are not bringing R&D concepts that are promising for the public sector quicker to the market.[57]

EU illustrative example:

The problem of appropriate R&D funding was described by stakeholders in the following way:

"This is a classic question concerning technology push and market pull. There is always a gulf between the manufacturers, researchers and the market. Researchers often have difficulties to identify the market needs, as the market needs tend to be evolutionary rather than revolutionary which is always more interesting to a researcher. The entities that fund research are also often composed of technical people that share the same views, they hence tend to fund programs which are more aligned with technology push rather than market pull. This results in very little take up of the new technology and very long development times. Companies will only invest if they can address an available market rather than in blue sky research. It is therefore essential that the market is defined properly to overcome the lack of interest from the demand side to invest into R&D."

Demand side:

The consequence for the demand side is that it is often faced with a supply-driven R&D procurement, rather than a demand-driven R&D, given that industry wants to have a return on its R&D investment, which the demand cannot guarantee. However, this means that sometimes products are procured which are either not entirely fitted for the destined purpose, or they have a level of technology sophistication which is not required for the destined purpose and leads to a more expensive procurement.[58] Furthermore, in case that promising R&D concepts are not brought to the market or only brought to the market at a later stage, this means that technologies that could improve the security of the citizen are not available for public procurers. Eventually, similarly to the private sector, this means that a notable amount of public R&D investment is not used in the most efficient way.[59]

A series of initial initiatives, aimed at closing the gap between research and market, have already been launched by the Commission through the Security Theme of the 7th R&D Framework Programme, notably through the involvement of end-users in so called demonstration projects and through Pre Operational Validation activities[60].

Noteworthy is also Directive 2009/81 on the procurement in the fields of defence and security, which expressly provides that the contracting authority/entity may buy the product developed within an R&D contract without having to organise a separate procurement procedure if certain conditions are met.

· US illustrative examples

The US has clearly recognised the need to fill the gap between research and market in the security area. To that effect, the US has created two instruments:

· The Small Business Innovation Research (SBIR) Program of the Department of Homeland Security (DHS), which is aimed at increasing private sector commercialization of innovations and at promoting the participation of SME's in homeland security research. The targeted areas are: Borders and Maritime Security, Chemical/Biological Defence, Cyber Security, Explosives, Human Factors/Behavioural Sciences and Infrastructure Protection and Disaster Management[61].

· The US Safety Act provides for legal liability limitations of anti-terrorism technologies. The goal of the SAFETY Act is to encourage the development and deployment of new and innovative anti-terrorism products and services by providing liability protections. The legal text states "The purpose of the Act is to ensure that the threat of liability does not deter potential manufacturers or sellers of antiterrorism technologies from developing, deploying, and commercializing technologies that could save lives."[62] In other words, this instrument by promoting innovative technologies is aimed at closing the gap between research and market.[63]

This disadvantageous difference between the EU and the US was also underlined by the large majority of the industry participants to the public consultation, who stated that:

"The industrial base across the EU is however fragile in the sense that it is currently losing out to industries in countries such as the United States in a fiercely competitive global security market; in significant part owing to the support industries outside receive from their host Governments. The industrial policy framework for helping companies in the EU to compete in the security market is currently insufficient. Subsidies and related initiatives such as the US Safety Act mean that the security industry across the EU is losing its competitive edge in the global market."[64]

A specific issue with regard to closing the gap between research and market relates to civil-military synergies. The possible benefits for the security sector through the exploitation of synergies between civil and defence technologies remains to this date largely untapped. This is truer today than ever before, where certain technologies (e.g. electronics, telecommunications, surveillance, intelligence) developed by the defence sector could also be of relevance for internal security and vice versa.[65] In many cases civilian and military technologies share a common base which is then adapted to their specific needs. The same basic helicopter can for instance be modified for civilian or military utilisation.[66]

At the moment such synergies are partially taking place at the level of R&D cooperation. However, such synergies are currently neither sought more upstream at the level of capability development, nor more downstream at the level of standardisation. Such upstream synergies could help civil security users in better defining their research requirements with a view to ensure that the subsequent procurement is based on clearly defined needs. And such downstream synergies could as well help in reducing the gap between research and market, as the potential market would be bigger if "hybrid" standards were to exist, thus encouraging industry to explore promising R&D concepts.

Underlying drivers of the gap between research and market

The underlying driver of the gap between research and market is largely due to the lack of information about security technologies and capabilities from the side of the public authorities. This can be contrasted with the defence area, where public authorities are well accustomed in defining their future technology requirements and pulling the development through from research to the actual purchase[67]. This culture is, however, still missing in the area of civil security, not the least because in the civil security purchasing is normally more short term than based on a long term planning like in the defence domain[68].

Another driver is the fact that the security end-user is highly diversified between central and local governments, police forces and border guards, etc etc up to private end-users like commercial security service companies and infrastructure operators. In contrast in the defence domain there is generally only one customer, the Ministry of Defence[69].

3.2.3. The uncertainty of societal acceptance for security technologies

Another problem is the uncertainty associated to the societal acceptance of security technologies.

The societal acceptance of products and technologies is a general problem across many different industrial sectors. A good example for one of the liveliest debates of the last years was for instance the debate about the commercialisation of genetically modified food. There are however a number of specificities that distinguish security technologies from other areas.

The main reason for the specificity of the security market is that security technologies, devices and measures implemented often concern fundamental rights (e.g. privacy, freedom, etc.)[70]. Any possible endangerment of these fundamental rights immediately raises concern among the population and often suscitate a very visible and concrete reaction.

A second aspect is that in, most cases, when security technologies, devices and measures are implemented, citizens do not have the choice to avoid them. For example, the only way to avoid security measures in airports would be not to travel by plane.

Another aspect is that security technologies are in many cases highly visible. Security cameras, access gates or security scanners are becoming more and more part of our daily environment. Everyone who goes to an airport is directly confronted to a detailed examination of their person and belongings. Passing through an airport checkpoint is also a very concrete experience and not something relatively abstract such as for instance the genetic code of our food. Security technologies are therefore often perceived as an intrusion of our personal sphere[71].

Responses to the question: "Do you agree with the problem definition, that security products need to be privacy compliant from the development to the production?

Respondent profile || Do not agree at all || Do not agree || Agree || Agree very much || Do not know

A business association || 1 || 1 || 4 || 4 || 3

A national administration || || || 1 || 2 || 1

An academic institution or think tank || || 1 || || 2 ||

An individual || || || || 1 ||

Large enterprise (more than 250 employees) || 1 || 2 || 6 || 8 || 2

Medium enterprise (between 50 and 249 employees, turnover less than €50 million) || 1 || 1 || 2 || 1 ||

Micro or small enterprise (fewer than 49 employees, turnover less than €10 million) || 1 || || 2 || 3 ||

Non governmental organisation || 1 || || || 3 ||

Other || 1 || || || 2 ||

Regional or local administration || || || || 1 ||

Grand Total || 6 || 5 || 15 || 27 || 6

Supply side:

These societal aspects have a very tangible effect for a company that wants to invest in security technologies. The security industry has to be sure that its products will be compatible with the general opinion of the public. The commercialisation of their new technologies would otherwise be impossible. The financial and human efforts that go into the development and production of a security product can therefore be easily wasted.

This uncertainty consequently reduces the willingness of the EU industry to invest in the development of new technologies, if they do not have an assurance of its economical viability. The lack of a proper technological implementation of societal and ethical aspects in the drafting of technological requirements thus ultimately weakens the competitiveness of the EU security industry. At the same time third country competitors who do not have such constraints can however develop technologies which can be commercialised in their own markets as well as in other non-EU countries[72].

EU illustrative example:

Illustration: Biometric screening

An example for this problem is the use of biometrics technologies for the screening of people at external borders. Further development of these technologies is currently hindered by the fact that no clear and transparent common criteria on privacy requirements have been established. Manufacturers of security technology cannot therefore make the necessary investments to develop privacy enhancing technologies as an integrated part of their technology solutions.

Demand side:

The demand side is also confronted with an unsatisfying situation, in which they cannot acquire the technology they initially intended to purchase. Eventually the demand side is forced to purchase a less controversial product which does however not entirely fulfil the technological requirements.

EU illustrative example:

Illustration: Terahertz scanners

A good example for this issue is the well known case of Security Scanners (know to the wide public as "Body Scanners"), based on mm-wave technology and used for access control and border checks (such as airports). Electromagnetic radiation in the mm-wave region can penetrate fabrics and plastics, so it can be used in surveillance to remotely uncover concealed weapons on a person. As much as this technology is efficient as much protest it generated from public and civil rights groups.[73]

The European Parliament bought six of those scanners for €725,730 in 2005 as a precaution measure after the 2001 al Qaeda attacks on New York and Washington. In October 2008, lawmakers had opposed a proposal allowing the use of full body scanners in the EU, unaware of the six unused devices lying around in the basement.[74] In the end the EP never unpacked these scanners and auctioned them away in 2010.

The results of the public consultation also reflected the importance accorded by all stakeholders, be they public or private, to the proper implementation of privacy concerns into technical requirements. On the question "Do you agree with the problem definition, that security products need to be privacy compliant from the development to the production" (i.e. the concept of "privacy by design")[75] over 70% of the participants stated their agreement.

Stakeholder contribution on this issue, taken from the Public Consultation

Body scanners: some EU Member States do not allow the use of certain types of body scanners (x-ray backscatter). Although these systems comply with all standards, including Euratom, they are excluded. This blocks the EU internal market for security scanners and the development of a one-stop-security system.

Underlying drivers of the ethical concerns

The different ethical sensitivities among Member States

The approaches on the ethical issues related to security vary considerably among the Member States. A measure that is perceived by one Member States as completely uncontroversial could be unthinkable in another. A good example for this are for instance the different regulations of identity cards across the EU. While in some countries like the UK citizens are not obliged to have an ID card, in others countries like Germany, France and Portugal ID cards are not only obligatory, they also include a fingerprint of the card holder. The diverging regulations are often the results of lively debates among the citizens.

These varying perceptions of security have also been confirmed by a recent EUROBAROMETER report on the perception of internal security by the European citizens. A table, taken from this report, summarising the different priorities for EU citizens on internal security aspects can be found under Annex 5.

Two main questions arise out of this circumstance: which ethical standards should apply? and how should those ethical concerns be implemented into technical requirements?

While a certain number of general rules exist, such as for instance articles six to eight of the "Charter of Fundamental Rights of the European Union" (6 "Right to liberty and security"[76], 7 "Respect for private and family life"[77] and 8 "Protection of personal data"[78]), the technical translation of ethical concerns into legally binding technical requirements still remains largely unclear[79].

This already complex and sensitive situation is further complicated through the lack of a common EU wide approach on the technological requirements for privacy compliance of security technologies. The approaches to security of the Member States vary considerably, some countries face fierce reactions to any possible intrusions to the privacy of citizens, while others can operate more freely, notably in the area of surveillance.

This issue has also been addressed in the recent Commission Communication "A comprehensive approach on personal data protection in the European Union"[80] (i.e. the possible creation of EU certification schemes (e.g. ‘privacy seals’) for 'privacy-compliant' processes, technologies, products and services)[81].

Another aspect, connected to the societal dimension, which influences the structure of the EU security market, are the financial constraints related to the uncertain privacy requirements. A company will be less willing to invest in a technology or product if they do not have the assurance that they will actually be able to commercialise it. Moreover, the imposition of too cumbersome ethical requirements can also discourage companies from investing in the development of new technologies, should these appear to be economically unviable. An example for this are the already mentioned "Body Scanners".

Civil-military synergies

The possible benefit of an enhanced Civ-Mil cooperation for the civilian security sector is a highly sensitive topic. Civil rights movements have often stated their fear of a "militarisation" of the civilian sector. Most administrations have therefore refrained from launching effective initiatives to promulgate the integration of military technologies into security related applications.

The potential benefits of synergies have, however, been acknowledged on numerous occasions by the European Council through a number of declarations and conclusions.[82]

4. The current Situation

4.1. Market fragmentation

The current situation is well exemplified with regard to certification/conformity assessment procedures. Member States have their own national certification systems in place with no mutual recognition of certifications taking place. In addition, the current situation can be described as quite uneven in that some Member States have for the same products certification procedures in place, whilst other Member States have no procedures in place. This uneven situation combined with a lack of mutual recognition would in all likelihood continue.

Another good example are standards. The Commission currently mandates on an ad-hoc basis the European Standardisation Organisations. Whilst not many European standards in the area of security exist, the current situation can, nevertheless, be described as a patchwork of standards rather than standards being developed with an overall design in mind for what the standardisation landscape should look like.[83]

The Commission submitted, in 2011, a so-called programming mandate (M/487) to the European Standardisation Organisations which aims at providing such identification, as well as providing a gap analysis. However, in itself if this programming mandate is not followed-up through specific standardisation mandates based on a clear prioritisation developed together with stakeholders, the current patchwork situation would continue to exist.

The central EU wide effort to address the issue of security on the level of security research is the FP7 security research theme.[84] A specificity of this theme is its end user and market oriented nature, bringing together representatives from national authorities, industry, research and end users. A number of these projects are thus also focussed directly on issues relevant to the competitiveness of the EU security industry such as standardisation, the economical aspects of security and interoperability.[85]

4.2. Gap between research and market

At the moment no pre-commercial procurement (PCP) is taking place at EU level (i.e. via FP7) in the area of security. Pre-commercial procurement is understood here as an approach to procure R&D services, whereby the Intellectual Property Rights (IPR) do not belong (exclusively) to the contracting authority[86]. Through such an approach the end-user will define its requirements at an early stage, thus allowing industry to focus R&D efforts on the technical specifications required by that end-user. At Member State level some very few Member States have been experimenting with PCP schemes. This is for example the case in the Netherlands. Again, we can speak of an uneven situation in the Member States which would continue under this situation.

It should be noted, that the Commission has recently published a proposal for Horizon 2020 which contains a specific PCP funding scheme. However, having such a scheme and making use of such a scheme are two pair of shoes. Given that so far few Member States have used PCP in the area of security, without a forceful promotion of this scheme by the Commission, it is unlikely that this scheme would be used for security under Horizon 2020[87].

So far neither the EU, nor Member State introduced legislation on third party liability limitation in the area of security. The Commission also has so far not taken any concrete action with regard to third party liability limitation. Potentially, this could mean that some technologies may not be brought onto the market, as companies might consider the liability risks linked to these new technologies to be too high.

Civil-military synergies are currently being sought with the European Defence Agency through the so called European Framework Cooperation. Under this cooperation that has been asked for by the Council, there is an on-going coordination between the FP7 Security Theme and EDA's defence research activities. The aim is to synchronize this research in such a way as to avoid duplications and to profit from possible synergies. Without any additional initiative this cooperation would continue. However, this would mean that synergetic effects would be limited to the research domain.[88]

4.3. Integration of the societal dimension into industrial policy

It should be underlined that there exists no EU security industrial policy at the moment. This does however not mean that the societal dimension is not addressed at EU level. Currently activities are limited to R&D, where via its FP7 Security Theme the EU finances research projects in the area of security that look into how to better integrate ethical aspects into technology, e.g. through research into privacy by design technologies. It is afterwards left to industry whether they pursue these technologies and actually integrate them into products hitting the market.

In some areas it is likely that industry will indeed integrate ethical concerns, notably privacy issues, into its products. However, without any measures taken at EU level, it is unlikely that a more comprehensive approach will be taken by industry on this. It will remain a case by case consideration made by industry.

5. EU right to act

Problem 1: The fragmentation of the EU security markets

Article 26 (1) of the Treaty on the Functioning of the European Union (TFEU) foresees that the Union shall adopt measures with the aim of establishing or ensuring the functioning of the internal market".

As the participants to the public consultation unambiguously stated, EU action is necessary to overcome the fragmentation of the security markets.

Problem 2: The gap between research and market

Article 173 (1) of the TFEU states that the Union and the Member States shall ensure that the conditions necessary for the competitiveness of the Union's industry exist. Actions to that effect shall be aimed inter alia at "fostering better exploitation of the industrial potential of policies of innovation, research and technological development".

The participants of the public consultation were adamant on the need to improve the competitiveness of the EU security industry.

Problem 3: The uncertainty of societal acceptance for security technologies

Article 67 of the TFEU states that "The Union shall constitute an area of freedom, security and justice with respect for fundamental rights and the different legal systems and traditions of the Member States".

More than 70% of the participants of the public consultation stated that the societal dimension and more specifically the privacy compliance of security technologies was essential.

Security as a national prerogative

Whilst the Treaty of the European Union states that the essential State functions, including ensuring the territorial integrity of the State, maintaining law and order and safeguarding national security remains the sole responsibility of each Member State (Article 4, paragraph 2), there is an evident link between national security and security of the Union, which is further spelled out in the Treaty of the European Union. Thus, the Union "shall offer its citizens an area of freedom, security and justice" (Article 3, paragraph 2).

The EU right to act was also unmistakeably supported by the participants of the public consultation. Over 86% of the participants agreed that action by the EU would be necessary to reduce the market fragmentation and to reinforce the industrial base in the security area. Not a single respondent answered with "no".

The issue of a security industrial policy was also presented to and discussed with on several occasions to the Programme Committee of the FP7 Security Theme. The FP7 Programme Committee is constituted by representatives from Ministries (Interior, Research, Economics and Defence) from the EU 27 Member States and 14 associated countries.[89] A large number of Member State expressed their support for EU action during these meetings, no Member State objected on the presented policy measures.

A further aspect that should be taken into account when assessing the EU Right to act is related to the financial and technical capabilities in the Member States on security technologies. Only 7 (France, Germany, The UK, the Netherlands, Sweden, Austria and Finland) of the EU 27 Member States currently have a national security research programme. The FP7 security research theme represents more than 50% of the whole EU wide funding for security research. Only a very limited number of Member States have national capabilities to address issues related to security technologies, the large majority depend on EU initiatives.

It is very unlikely that the Member States will overcome those challenges on their own. As the participants to the public consultation and to the Workshops (among which representatives from Austria, Belgium, France, Germany, the Netherlands, and Spain) unambiguously stated, EU action is necessary.

6. Objectives

The general policy objective is to enhance the competitiveness of the EU security industry.

Increased competitiveness of the EU companies on a worldwide level, but also stronger competition inside the EU would allow the mostly public end users to purchase more adequate technologies with a better cost-benefit ratio. The central beneficiary of this evolution would be the European citizen, who would see his security enhanced.

The importance of the European Union for security of its citizens has been clearly stated in article three of the "Treaty on European Union"[90]as well as article six of the Charter of Fundamental Rights of the European Union[91].

The specific objectives are to reduce the fragmentation of the EU security markets, to reduce the gap between research and market, and to contribute to a better integration of societal aspects into security industrial policy. For each of these, operational objectives are reflected in the following table.

General and specific objectives ||

General objectives || Specific objectives || Operational objectives

Enhance the competitiveness of the EU security industry || Reduce the fragmentation of the EU security markets || · Improve mutual recognition of security products · Speed up standardisation in the area of security

Reduce the gap between research and market || · Encourage Pre-Commercial Procurement · Analyse the need for a third party liability regime · Strengthen civil-military synergies

|| Contribute to a better integration of the societal dimension into industrial policy || · Introduce societal aspects at the pre-commercial development level of products · Introduce societal aspects at the production process level

7. Envisaged policy initiatives

The stakeholder consultations (public consultations as well as workshops) as well as the studies launched by the Commission services identified a progressive step by step approach to be the most suited and feasible approach to address the problems of the EU security industry.

The main advantage of such a step by step approach would lie in its analytical and progressive nature, i.e. no legislative initiative would be launched by the Commission without a prior consultation of all the relevant stakeholders (be they public or private), a thorough analysis of the legal framework and finally a dedicated Impact Assessment. The approach thus ensures that no legislative initiative could be initiated that could have a detrimental effect on the EU citizens, Member States or industry (large, medium or small enterprises).

Area || Initiative || Stakeholder approval rate

Certification || Step by step certification/conformity assessment procedures focused on certain priority areas or priority technologies where there is a clear EU added value. || 71.19%

Standardisation || Step-by-step end-user driven standardisation based on a careful identification of existing, national, European and international standards, via Commission mandates to ESO's || 76.27%

Pre Commercial Procurement || A focused pre-commercial procurement scheme being built up via the possible future FP8 and/or CIPII funding. || 76.27%

This approach would focus on initiatives that could probably be agreed with the European Parliament and Member States in the short-term and would identify areas where action should be taken in the medium-term or where further study was needed for the long-term.

7.1. Market fragmentation

Certification/conformity assessment procedures

The EU would introduce certification/conformity assessment procedures for certain priority technologies or areas. Based on the study commissioned, as well as intensive stakeholder consultations, it is considered that in a first step the following two areas should be covered by an EU wide certification scheme:

· alarm systems ; and

· airport screening (detection) equipment.

Both areas were chosen by the Commission services as they would:

· directly address one of the central problems of the security markets: fragmentation due to the lack of harmonised standards and certification procedures for security technologies;

· create substantial benefits and cost savings in each of the targeted segments;

· encourage the establishment of an EU brand for the concerned technologies, thus raising the profile of European technologies in comparison to their international competitors;

· be relatively unproblematic from a political and technical point of view, as they would build on a pre-existing legislative and technical basis and given that a strong support for EU action on those segments has been expressed by all stakeholders; and

· should be uncontroversial on a societal level, as they would not affect any ethical or privacy related issues.

A detailed explanation on these aspects can be found in the following passages as well as in the annexes 7 to 10.

Alarm systems

As regards alarm systems[92], there exist already some European standards, and in addition there exists an industry-led certification mechanism called CertAlarm. CertAlarm is the only European Accreditation endorsed certification scheme for the fire and security industry. CertAlarm has been initiated by the main business association for alarm systems in the EU, EURALARM. EURALARM encompasses national associations of 14 European countries, with around 700 companies having a total turnover of approx. 3.5 billion Euro, i.e. approx. 70 % of the total European market for alarm systems.

However, this system is faced with the problem that it is privately run and authorities of Member States have no obligation to accept certificates established under the CertAlarm scheme.[93] The potential for cost savings through the introduction of a harmonised EU wide certification scheme is therefore left untapped.

Stakeholder contribution on this issue taken from the Pubic Consultation:

"We would recommend to develop and push acceptance by Member States of pan-European certification schemes which will definitely remove intra-EU barriers to trade. The CertAlarm scheme could certainly constitute a basis for other similar certification schemes."

A detailed overview on the quantitative analysis of benefits of a harmonised certification scheme can be found in the illustration below and in Annex 8.

The Commission would address this issue by announcing the drafting of a legislative proposal setting up an EU-wide conformity assessment scheme for alarm systems. Such a legislative proposal would evidently be preceded by a dedicated Impact Assessment.

Illustration: competitiveness effects for alarms The development of EU-wide harmonised standards and a common conformity assessment procedure is expected to significantly reduce the certification costs for suppliers of intruder alarm systems where they serve multiple national markets in the EU. Moreover, it should reduce costs incurred in developing variants of products that are adapted to comply with differing standards and conformity assessment procedures at national level, which industry stakeholders consider often have limited actual impact on product performance for final customers. Removing the need for multiple certifications would enable suppliers of alarm systems to more rapidly access different parts of the EU market which, in turn, could benefit the organisation and scale of production activities. Further, by reducing delays in ‘time to market’ caused through multiple certification requirements, an EU-wide scheme should reduce the risk of new product innovations being replicated by competitors. Thus, an EU-wide scheme should increase the potential return and reduce the level of risk associated to investments in research and technology development. Although a handful of major players dominate both the EU (and US) market, there remain many niche markets that are very attractive for SMEs, either directly or through the supply of specialized products and components to major manufacturers and integrators, and to the installation service market. Conformity assessment and certification costs represent a proportionately higher share of total costs for SMEs and consequently a greater market access barrier. Accordingly, they are expected to benefit in particular from the cost savings resulting from EU-wide harmonised standards and certification procedures. In addition, an EU certification scheme should serve as a recognised mark of product performance and quality that can reduce the importance of ‘reputation effects’ of larger players and local companies, thus facilitating SMEs to trade across borders within the EU and even in global markets. Overall, an EU-wide scheme is expected to increase market efficiency in the EU by raising the level of competition – both between EU companies and from outside the EU – and stimulate improvements in industry performance levels (e.g. productivity). It is not expected, however, that the reduction in costs resulting from an EU-wide approach would have a significant impact on the price competitiveness of EU alarm products in international markets. Nonetheless, a less fragmented EU market should encourage investment in research, technology development and innovation, which would have an impact on ‘dynamic’ competitiveness. Further, to the extent that it obtains higher market recognition than existing national schemes, an EU-wide certification scheme (providing for a corresponding EU security ‘performance mark’ or ‘quality label’) should contribute to strengthening broader international market awareness and acceptance of EU products.

Airport screening equipment

As regards airport screening[94] equipment there exists a whole body of EU legislation which sets out performance requirements for such equipment (see Regulation EC 300/2008, Regulation EC 272/2009 and Regulation EU 185/2010). However, this legislation does not contain the underlying conformity assessment mechanism which would be required so that a screening equipment certified in one Member State (according to EU performance requirements) is mutually recognised in any other Member States.

The Commission would announce the drafting of a legislative proposal that would set up an EU wide conformity assessment scheme, initially referring to the performance requirements already set out in EU legislation with regard to airport screening equipment. This legislation could easily be extended in the future when performance requirements will have been developed for related areas (e.g. port security). Such a legislative proposal would evidently be preceded by a dedicated Impact Assessment.

It should be underlined that, given that the performance requirements already exist at the EU level, through EU legislation there would not be a need to “harmonize” national security policies.

This legislation could easily be extended in the future when performance requirements will have been developed for related areas (e.g. port security).

Illustration: competitiveness effects for airport screening By promoting mutual recognition of certification, the proposed EU-wide scheme should remove – or, in so far as Member States set more stringent requirements, reduce – the necessity for equipment to undergo multiple/additional national conformity assessment procedures. Consequently an EU-wide scheme is expected to reduce costs (direct and indirect) for conformity assessment and certification for suppliers of aviation security screening equipment which, for example, the European Organisation for Security indicates can be as much as € 2 million of a large scanning machine undergoing certification throughout the EU. Furthermore, a common certification scheme should reduce the ‘time to market’ between product development and commercialisation, which would be beneficial both to industry and to customers looking to deploy new security technologies and solutions. Industry representatives also point to the benefits of a more unified and predictable market environment. The scheme should ensure that, once equipment is certified, it will be accepted throughout the EU as meeting the necessary EU performance requirements. Thus the potential market within the EU can more readily be identified and conditions for competition will be more transparent. This would provide inter alia for a reduction in the uncertainty associated to investments in research and technology development (RTD), which is expected to be of particular benefit for the aviation security screening sector given the importance of technology development in underpinning competitiveness. Overall, by contributing to a less fragmented and more transparent market, the proposed scheme would raise overall market efficiency and industry performance levels. The introduction of an EU-wide scheme is not expected to significantly alter the overall structure of the aviation security screening sector in which the major players already compete at a global scale. For smaller players, it is thought unlikely that the proposed EU-wide scheme would significantly alter their capability to challenge the major equipment suppliers and systems integrators. However, in so far as EU certification serves as a recognised mark of product performance within the EU market, then it may facilitate SMEs to act as supplier to the major players in the sector. At an international (global) level, in addition to providing an indicator of product performance, a unified EU approach should facilitate international dialogue towards greater reciprocity (notably with the USA) in the recognition of certificates that would reduce costs associated to third-country certification and enhance international market access for EU certified products.

As regards standardisation, the Commission would instigate an end-user driven standardisation based on a careful identification of existing, national, European and international standards. As mentioned above, to this effect the Commission already submitted a so called programming mandate to the European Standardisation Organisations (M/487) which aims at providing such identification, as well as providing a gap analysis. Major gaps were identified in the following areas:

– Chemical, Biological, Radiological, Nuclear and ExplosivesCBRNE – minimum detection standards as well as sampling standards, including in the area of aviation security;

– Border security – common technical and interoperability standards for automated border control systems, as well as standards for biometric identifiers; and

– Crisis management/ Civil protection – standards for communication interoperability, as well as interoperability of command and control, including organisational interoperability, as well as mass notification of the population.

7.2. The gap between research and market

The Commission services would build on the PCP scheme to be built up via Horizon 2020. This scheme also foresees the possibility of a top-down PCP scheme, i.e. where such a PCP scheme would be organised via appropriate EU agencies. The Commission would make full use of this new funding scheme with regard to security research. Additionally, the Commission would encourage the Member States to launch similar initiatives on a national level, in compliance with Directives 2004/18 for non-sensitive and 2009/81 for security sensitive procurement.

Concerning third party liability limitation there is a strong request from industry to introduce something similar to the US Safety Act in Europe. However, there are clear limitations with regard to EU competence in this area, as well as to whether this would have a concrete effect on the competitiveness of the EU industry. All issues related to third party limited liability protection (legal, economic, etc.) would be further studied.

Regarding civil-military synergies, so far cooperation focused on the research area. However, the more downstream elements of such synergies have largely remained untapped. The idea is that there are some areas where "hybrid standards" could be foreseen, covering the civil and the military domain. A good example are Unmanned Areal Vehicles (e.g. relating to sense and avoid systems or airworthiness requirements) and reconfigurable and cognitive radio (also known as Software Defined Radio). Technology in these areas is very similar if not the same in the civil and military domain. In these areas the Commission, in close cooperation with EDA, would issue standardisation mandates.

7.3. The integration of the societal dimension

Concerning the societal dimension, an effort would be made to introduce this dimension at the stage of the production process. This means that an economic operator wishing to have his production process audited for being "privacy by design" fit, would have to fulfil a set of requirements defined through an appropriate EU standard that would be mandated by the Commission to the ESOs. Such a standard could be modelled on existing schemes, such as for example the existing standards of the ISO 29100 family developed in the Privacy Standardization ISO/IEC JTC 1/SC 27/WG 5 «Privacy & Identity Management Technologies». It would, however, remain voluntary for companies to apply such a standard. There would, nevertheless, be a strong peer pressure.

Also at the level of the pre-commercial development of products the societal dimension would be introduced. This would be done by using the PCP scheme outlined above to also "test" the societal acceptance of new technologies.

7.4. Overview of the envisaged policy initiatives

This table gives a brief summary of policy initiatives envisaged by the Commission services as possible areas for EU action.

Policy area || Action

Certification || The EU would launch certification/conformity assessment procedures focused on certain priority areas or priority technologies where there is a clear EU added value. Based on the results of the studies and the stakeholder consultations the two following areas were identified to be the most promising: airport screening equipment and alarm systems.

Standards || The Commission would instigate an end-user driven standardisation based on a careful identification of existing, national, European and international standards, via Commission mandates to European Standardisation Organisations.

Pre-commercial Procurement || Making full use of the pre-commercial procurement scheme being built up via "Horizon 2020". PCP would be organised in a top down approach, via agencies such as FRONTEX. The Commission would furthermore encourage the Member States to launch similar initiatives on their national level, in compliance with Directives 2004/18 for non-sensitive and 2009/81 for sensitive security procurement.

Third Party Limited Liability Protection || The Commission would launch a thorough analysis on all issues related to third party limited liability protection. (e.g. dedicated studies, public and targeted consultations of all relevant stakeholders in the EU). All possible options of liability schemes will have to be taken into account in the context of this analysis (e.g. the creation of a victim compensation fund, etc).

Civil – military synergies || The Commission would strengthen the synergies between civilian and defence technologies through a downstream coordination at the level of development of standards.

Societal aspects || The economic operator wishing to have his production process audited for being "privacy by design" fit, would have to fulfil a set of requirements defined through an appropriate EU standard that would be mandated by the Commission to the ESOs. Such a standard could be modelled on existing schemes, such as for example the ISO 9000 quality management scheme, but applied to management of privacy issues during the production process, e.g. the ISO 29100 family developed in the Privacy Standardization ISO/IEC JTC 1/SC 27/WG 5 «Privacy & Identity Management Technologies».[95] It would, however, remain voluntary for companies to apply such a standard. PCP schemes would be used to "test" the societal impact of new technologies.

8. The Expected benefits of the envisaged policy initiatives

The launch of a successive set of policy measures on certification, standardisation and pre-commercial procurement is expected to have a highly positive effect on the EU security industry.

The step by step approach would ensure that the policy initiatives are based on a thorough and well founded analysis of the EU security markets. Thus enabling the Commission to identify the most appropriate and efficient policy measures needed to address the main currently existing obstacle for the creation of a true internal market for security: the fragmentation of the national regulatory frameworks.

8.1. Market fragmentation

The central envisaged EU action would be the development of adequate EU wide harmonised standards and certification procedures for alarm systems and airport screening equipment. This would not only open up the national security markets and develop the competition among the EU security companies, it would also reduce the cost of commercialising security products and improve the choices for end-users.

The expected positive consequences of harmonised EU wide certification procedures are:

· reduction of costs associated to multiple testing;

· facilitated access to markets;

· reduction of the "time to market";

· improved transparency of performance requirements and standards;

· enhanced competition among EU suppliers;

· reduction of costs for conformity assessment and certification (CAC) services and the development of security technologies;

· lower prices for security technologies

Producers of security technologies should benefit from the introduction of EU wide harmonised CAC procedures in the targeted sectors. The most evident being the reduction of costs associated to the multiple testing of security technologies across the Member States. The cost for CAC procedures of basic security technologies can amount to several hundred thousand Euros per Member State. Committing these costs just once, instead of multiplying them by 27 for each of the Member States, can enable producers to save several million Euros in the development and commercialisation cost of new technologies.

For the two targeted areas, the cost-benefit analysis shows that up to 29 million EUR yearly could be saved in certification costs. A detailed overview on the quantitative analysis can be found under Annex 8.

Alarm systems:

The total costs for certification and conformity assessment of intruder alarm systems is currently estimated to range between EUR 6.2 million and EUR 13.2 million per year. These costs cannot be reduced completely through a harmonised certification scheme.. After all, there is still need for a single certification and conformity assessment, and associated need for testing etc. It is nevertheless assumed that a single EU system reduces the cost associated to differences in technical rules and multiple testing/certification by three-quarters (75%). This would suggest a saving of EUR 4.7 million to EUR 9.9 million per year.

Airport screening:

A harmonisation of the certification and conformity assessment procedures for airport scanners would prevent all duplications at national level, which allows for considerable cost savings. The cost for certification and conformity assessment would thus amount to EUR 3 million (30 products * EUR 100 thousand). This implies that the impact of the harmonisation in terms of reduction of costs for certification and conformity assessment would amount to approximately EUR 19 million per year[96].

A common CAC procedure should also increase the transparency of the certification process, giving producers a better understanding of the required performance standards. A single EU wide CAC system should also improve the openness of the markets, thus facilitating the market access for the producers of security technologies. The particularly pronounced problem of the hurdles to market entry in the security sector should subsequently be reduced.

This facilitation of market access should have an especially notable effect on SMEs. As previously stated SMEs have a more limited access to financial resources and suffer the most from the burdens imposed by multiple CAC procedures. The reduction of costs associated with moving to a ‘one-stop’ system with mutual recognition of certification would be greater (in relative terms) for SMEs.

Harmonising the certification procedures for airport screening systems and alarm systems should also have a positive effect on the creation of a clearer European identity for these technologies, a possible "EU brand". This "EU brand" should contribute to enhancing the global competitiveness of the EU companies with regards to their US and Chinese competitors.

As confirmed by the stakeholder consultations[97], a single CAC procedure would considerably reduce the workload associated to the administrative burdens for security companies and public administrations, thus freeing-up human and financial resources.

8.2. Gap from research to market

The launching of dedicated policy measures with regard to pre commercial procurement would strongly help in better aligning R&D projects with security requirements and end-user needs, thus contributing in closing the gap between research and market.

A tentative assumption of a 1% increase in the annual growth rate due to R&D support through a PCP scheme would lead to extra sales of 2 billion € and to an in