WRITTEN QUESTION E-3205/02

by Kathleen Van Brempt (PSE) to the Commission

(11 November 2002)

Subject: Computer viruses

Firms and private individuals are experiencing more and more frequent damage as a result of computer viruses.

Can the Commission say how many computer viruses there are each month in the EU? Can it provide data for the last two years to show the trend?

How many computer viruses occur each month in Belgium? Can the Commission provide data for the last two years to show the trend?

Is this a growing problem?

What is the amount of economic damage caused by computer viruses?

What measures is the Commission taking to tackle the problem?

Answer given by Mr Liikanen on behalf of the Commission

(5 February 2003)

Electronic communication networks and information systems are now an essential part of the daily lives of European citizens and are fundamental to the success of the Community economy. Networks and information systems are converging and are becoming increasingly interconnected. Despite the many benefits of these developments, these infrastructures have their own vulnerabilities and offer new opportunities for criminal conduct and digital vandalism. The Commission is very concerned about the increasing prevalence of viruses and other malicious code.

The Commission does not gather statistics on the precise number of viruses and other malicious code that are released and does not investigate the amount of damages caused. There are various reports publicly available that give diverging estimations. The site www.securitystats.co.uk/virusstats.asp lists a number of sites that provide statistics on viruses and damages. On most counts, there are well over 70 000 viruses around and the number is growing exponentially. In itself, these figures are not that meaningful. The damages caused by a virus depend on numerous factors, including the speed with which it spreads, the ease with which it is detected by anti-virus protection measures, and the harm it causes on computers. The Commission believes that there are no reliable figures available on the amount of damages caused by viruses. Most companies and individuals do not report the number of incidents of successful virus attacks or the amount of damages, and in case damages are reported the methods of calculation vary widely and the accuracy is generally not checked.

Nevertheless, it is clear that viruses form an important and growing problem and the Commission has addressed the issue of malicious code in a number of Communications and initiatives. In January 2001, the Commission issued a comprehensive policy statement on cybersecurity and cybercrime, the Communication Creating a safer information society by improving the security of information infrastructures and combating computer-related crime(1). In June 2001,

the Commission issued the Communication Network and information security: proposal for a European policy approach(2), that went into greater detail concerning network security threats and proposed preventative measures. On the one hand, the Commission has proposed a series of preventive measures, and on the other hand it has proposed an initiative to give law enforcement the tools to bring the individuals that release viruses to justice.

Concerning preventive measures, the Commission has taken several initiatives as part of its e-Europe Action Plans and its IST Programme that stimulate the security of network infrastructures, facilitate the availability of security technologies, promote awareness of security issues and ways to protect computers, and support rapid responses to individual incidents (see http://europa.eu.int/information_society/eeurope/index_en.htm for further information). Network and information security is again a priority area in the Commission Work Programme for 2003. The Commission is currently examining how to improve the security of information and communication networks as indicated in the above mentioned Commission communication and the possibility to set up a network and information security entity as recalled in Council(3) and Parliament(4) resolutions on network and information security.

In April 2002, the Commission proposed a Framework Decision on Attacks Against Information Systems(5). This proposal addresses the most significant forms of criminal activity against information systems, such as illegal access to information systems, spread of malicious code, and denial of service attacks. The Framework Decision seeks to ensure that Europe's law enforcement authorities can take action against these new forms of crime. The Parliament has recently adopted a position on this proposal and it is currently under discussion in the Council.

(1) COM(2000) 890 final.

(2) COM(2001) 298 final.

(3) Council resolution 28.01.2002, OJ C 43, 16.2.2002.

(4) A5-0311/2002 final, EP resolution 17.9.2002.

(5) OJ C 203 E, 27.8.2002.