P6_TA(2005)0221

Protection of critical infrastructure

European Parliament recommendation to the European Council and to the Council on the protection of critical infrastructure in the framework of the fight against terrorism (2005/2044(INI))

The European Parliament,

- having regard to the proposal for a recommendation to the Council by Stavros Lambrinidis on behalf of the PSE Group on protection of critical infrastructures in the framework of the fight against terrorism (B6-0085/2005),

- having regard to the Constitutional Treaty, and in particular to Articles III-284 on civil protection and I-43, which provides that "The Union and its Member States shall act jointly in a spirit of solidarity if a Member State is the object of a terrorist attack or the victim of a natural or man-made disaster,"

- having regard to the Declaration on solidarity against terrorism adopted by the Heads of State and Government on 25 of March 2004,

- having regard to the "Hague Programme" [1] adopted on 5 November 2004, according to which "… effective management of cross-border crises within the EU requires not only the strengthening of the current actions on civil protection and vital infrastructure but also addressing effectively the public order and security aspects of such crises … Therefore the European Council calls for the Council and the Commission to set up … an integrated EU crisis management arrangement … to be implemented at the latest by 1 July 2006. This arrangement should at least address the following issues: further assessment of Member States "capabilities, stockpiling, training, joint exercises and operational plans for civil crisis management","

- having regard to the Commission communications:

a) to the European Parliament, the Council, the European Economic and Social Committee and the Committee of the Regions on Reinforcing the civil protection capacity of the European Union (COM(2004)0200), which evaluates the results so far achieved with, the weaknesses of, and possible improvements to, the European Union's civil protection capacity, notably as a first instrument on crisis intervention, founded on a voluntary basis,

b) to the Council and the European Parliament on Prevention, preparedness and response to terrorist attacks (COM(2004)0698), which emphasises the need for an integrated Community approach that should, inter alia, focus on proper communication of authorities with the public in case of a crisis, on the role of EUROPOL in the creation of a law enforcement alert mechanism to deal with terrorism and the establishment of a European Programme for Critical Infrastructure Protection (EPCIP), on security research, and on engaging in a structured manner the relevant parts of the private sector,

c) to the Council and the European Parliament on Preparedness and consequence management in the fight against terrorism (COM(2004)0701), which proposes to consolidate the emergency systems managed by the Commission in a secure general rapid alert system (ARGUS) linked to a Central Crisis Centre that would bring together representatives of all relevant Commission Services and would provide a permanent link between the Member States and the European Institutions,

d) to the Council and the European Parliament on Critical Infrastructure Protection in the fight against terrorism (COM(2004)0702), which proposes an EPCIP to be established in cooperation with the Member States and the relevant parts of the private sector and which will identify the possible shortcomings and the corrective measures (legal or of other kinds) to be taken,

- having regard to its resolution of 4 September 2003 on the effects of the summer heat wave [2], in which it called for a European Civil Protection Force to be created,

- having regard to the relevant legal bases in the Treaties which empower the Community and the Union to define and implement policies for supporting Member State action in protecting the health, security and safety of European citizens,

- having regard to Rule 114(3) and Rule 94 of its Rules of Procedure,

- having regard to the report of the Committee on Civil Liberties, Justice and Home Affairs (A6-0161/2005),

A. conscious of the continuing need of Europe's citizens to be protected against the risks linked with terrorist attacks (such as nuclear, radiological, chemical and biological, attacks in public spaces, etc.) but also with natural disasters (such as earthquakes, floods, fires, forest fires), with technological disasters (such as Seveso, maritime disasters, transport accidents), as well as with health and other crises (e.g., pandemics), in the context of an integrated European strategy, given that such events not only often have major cross-border consequences at a European level, but also make it necessary for the Member States to demonstrate solidarity with one another and for there to be in place a consistent and interoperable system of response,

B. noting that an effective strategy should focus both on preparedness (risk and threat assessments on critical infrastructure, heightened security measures, promoting common security standards and exchange of expertise, promoting EU-wide coordination and cooperation) and on managing the consequences of attacks and disasters (exchange of know-how and experience, scenario-building and training exercises and establishment of appropriate crisis-management, rapid-alert and civil-protection mechanisms),

C. convinced that, especially in the case of terrorism, when prevention and deterrence are undermined and attacks occur, only a well-organised and effective response system can guarantee an expeditious return to normality; only by increasing specialised skills, working closely together, pooling resources, guaranteeing risk assessment, information, training, communications and pre-emptive and post-disaster analysis, ensuring a prompt restoration to normality and, finally, by increasing funding and protecting victims with the necessary aid, can the Member States and the EU be better prepared to protect citizens when a disaster strikes within and outside the Union, with real or imminent consequences for EU citizens,

D. noting that critical infrastructure in the EU is becoming highly interconnected and interdependent, making it more vulnerable to disruption or destruction,

E. recognising that to protect critical infrastructure requires a consistent, cooperative partnership between the owners and operators of such infrastructure and Member State authorities; noting that analysing and managing risk in each infrastructure must be based on strict EU-set processes and standards; noting that the responsibility of managing risk within physical facilities, supply chains, information technologies and communication networks ultimately rests with the owners and operators who are in charge of the day to day running of those infrastructures; noting, however, that the EU and Member States should assist, instruct, support and monitor industry at all levels of public authority, including through financial and other incentives, as and when appropriate, to perform their obligations; noting, in this regard, that operators should be able to forward existing information to the authorities and that the latter take responsibility for analysing the information and devising appropriate security solutions in conjunction with the operators; whereas it is vital that the fundamental right to data protection is ensured at European and national levels in each individual case linked with these activities,

F. convinced of the need to strengthen computer protection systems in cooperation with European (e.g. ENISA) and national competent authorities in the face of an ever more sophisticated threat, by making use of leading-edge information technologies,

1. Addresses the following recommendations to the European Council and to the Council:

a) implement in full the European Council proposal to establish an "integrated EU crisis management arrangement" as an essential element in reinforcing the links between the citizens and the EU institutions and strengthening interdependence and solidarity between the Member States;

b) ensure that an integrated European strategy particularly addresses the threat to critical infrastructure, including computer facilities, the disruption or destruction of which would have a serious impact on the health, safety, security or economic well-being of citizens, and to establish a harmonised EU method so that Member States and operators can, through common standards and the organisations and persons in charge of security: identify critical infrastructure, analyse the vulnerability and interdependence thereof and the transboundary effects of crises and conduct the relevant threat assessments; and devise solutions to protect such infrastructure, prepare it for all hazards and provide an adequate response in the event of an attack or disaster occurring;

c) establish, on a proposal from the Commission and subject to Parliament's approval, a European Programme for Critical Infrastructure Protection (EPCIP) which should be financed by the Member States and/or by the owners and operators, on the basis of financial or other incentives, as and where appropriate; the Member States taking part should ensure that cooperation takes place, including public-private cooperation, and that there are the data and human and logistical resources needed for the various phases of the project, to meet the requirements of proportionality and subsidiarity, with particular regard to civil rights, data protection and security requirements;

d) take on board the fact that the EPCIP should be considered by the Member States' law enforcement agencies and those responsible for national civil protection mechanisms as complementary to national planning and awareness raising; that the success of the EPCIP should be evaluated independently and by specific standards; and that, on a proposal from the Commission, the Council should establish the EPCIP via an identifiable and achievable calendar of gradual implementation of specific and clearly defined steps and goals; and to recognise that, to be successful, a European Critical Infrastructure Early-Warning Information Network should assist in stimulating an exchange of information on shared threats and mutual vulnerability and devising appropriate measures and strategies to mitigate risk, in support of protecting critical infrastructure;

e) take on board the fact that:

- a European risk-analysis system should be created bearing in mind the data protection exigencies at European and national levels in cooperation with the European Data Protection Supervisor so as to ensure interoperability;

- there should be coordination between all the relevant authorities at national, European and international level which share information, which should include the data protection authority at the respective level;

- relevant information should be handled accurately, reliably and, if necessary, confidentially, whatever its source (military or civil intelligence, police cooperation); the appropriate parliamentary scrutiny should be ensured, through a specific inter-institutional agreement for this purpose when European internal security issues are at stake;

- it is necessary to create within the Commission a European early-warning system for crises to interlink the existing European, national and international specialised early-warning systems for emergencies, so that all relevant information which might require action at European level can be shared effectively through a central network (ARGUS);

- it is advisable to associate the European Committee for Standardisation (CEN) when sectoral standards do not exist or where international norms have not yet been established;

f) ensure that the EPCIP is:

- under continuous parliamentary scrutiny at European and national levels;

- an essential element of future developments at continental and world level [3];

g) improve, as a complementary measure, the functioning of the European Solidarity Fund (for intervention within the Union) and ECHO (for external interventions);

h) take over the proposal made in its abovementioned resolution to establish a European Civil Protection Force that would be able to monitor areas at risk of natural disasters in order to prevent the occurrence of disasters with enormous losses of human life, teams from which would intervene in events such as the recent tsunami catastrophe, wearing a common insignia so as to enhance the visibility of European solidarity;

i) strengthen social partnership by coordinating NGOs, civil society and local authorities;

j) ensure that alerts, advisories, and information notes, issued to help public and private stakeholders protect key infrastructure systems, as well as any alerts and advisories addressed to the general public in the context of civil protection emergencies, should be tailored to be absolutely necessary and appropriate so as not to unduly disrupt the daily lives of citizens and businesses or to create unnecessary fear or insecurity in the population;

k) ensure respect of privacy rights, so that consumers and operators can have confidence that information will be handled confidentially, accurately and reliably, and that business classified information will be properly managed and protected from unauthorised use or disclosure;

l) ensure that a European data protection and retention framework is simultaneously devised as soon as possible with relevant rules to be strictly applied in all fields and that the protection of fundamental rights of citizens is guaranteed;

m) ensure that training exercises to enhance the Union's civil protection and critical infrastructure protection capabilities will deal with realistic and up-to-date scenarios, drawing upon the experience and expertise of appropriate Member State specialists in civil protection and critical infrastructure protection (e.g. civil protection and critical infrastructure protection experts and scenarios from the Athens 2004 Olympic Games);

2. Instructs its President to forward this recommendation to the European Council and to the Council and, for information, to the Commission, the governments and parliaments of the Member States, the Council of Europe, and the UN and its specialised agencies.

[1] Updated on 17 December 2004 on the specific issue of fighting terrorism.

[2] OJ C 76 E, 25.3.2004, p. 382.

[3] See the proposal for reform of the strategy on civil protection and chemical, biological, radiological and nuclear threats discussed at UN level.

--------------------------------------------------