Opinion of the Economic and Social Committee on the "Communication from the Commission to the Council, the European Parliament, the Economic and Social Committee and the Committee of the Regions on network and information security: proposal for a European policy approach"
Date: 2001-11-28
Institutions: European Economic and Social Committee
Subjects: computer crime, data protection, information network, international cooperation, personal data, systems interconnection

21.2.2002

EN

Official Journal of the European Communities

C 48/33

Opinion of the Economic and Social Committee on the ‘Communication from the Commission
to the Council, the European Parliament, the Economic and Social Committee and the Committee
of the Regions on network and information security: proposal for a European policy approach’

(2002/C 48/07)

On 7 June 2001 the European Commission decided to consult the Economic and Social Committee,
under Article 262 of the Treaty establishing the European Community, on the above-mentioned
communication.

The Section for Transport, Energy, Infrastructure and the Information Society, which was responsible for
preparing the Committee’s work on the subject, adopted its opinion on 6 November 2001. The
rapporteur was Mr Retureau.

At its 386th plenary session (meeting of 28 November 2001) the Committee adopted the following
opinion by 113 votes to two, with three abstentions.

1.

Introduction

level of protection in each Member State, (ii) systems interop-
erability, (iii) the public security functions that are essential on
the Internet and (iv) Member States’ regulatory role.

1.1.
Internal networks in businesses, public administrations
and other bodies continue to grow at an exponential rate. The
same is also true of their Internet connections — and those of
private individuals. Were it not for the imminent takeoff of
fast Internet connection (1) and the setting-up — already under
way — of a new top-level domain name allocation system,
saturation point would not be far off.

Society,

1.2.
the economy, public administration and
national, civil and military security depend (and will increas-
ingly depend) on properly working, reliable networks and their
interconnections as well as on their bandwidth, the integrity
of the information they provide and, in many cases, data
confidentiality and the ability to identify precisely the parties
involved.

From now on, network and communication security is
1.3.
a strategic issue of
importance, requiring a
coordinated, coherent policy both among the EU Member
States and at global level.

the highest

As well as setting out proposals for action,

1.4.
the
Commission communication undertakes a very in-depth —
and, in the Committee’s view, well-documented — analysis of
the issues involved and of the current position.

2. The Commission proposals

2.1.
The Commission communication seeks to achieve a
joint approach to issues of network and data transmission
security in Europe. This involves promoting (i) an equivalent

(1) IPv6 standard, enabling 6 000 billion IP addresses.

2.2.
The aim is to ensure a ‘minimum’ degree of security
for networks and private individuals’ Internet connections —
and for inter-network connections — and to develop a culture
of security so as to foster broad awareness of the difficulties
and solutions involved.

2.3.
Overall security is determined by the weakest link in
the chain, and the gradual introduction of high-speed access
(ADSL, cable) and permanent Internet connections — includ-
ing for private individuals — is generating new protection
requirements. The same is true of e-commerce, where personal
data and consumers’ payment details must be protected. With
the growth of e-administration, protection is also required for
citizens’ personal data.

A sufficiently harmonised legal

2.4.
framework is also
needed to ensure that the offences of intrusion and data and
information misuse, the take-over of networks by hackers and
the deliberate spreading of viruses are defined and punished in
an equivalent way in each country.

2.5.
The Commission proposes a European warning and
information system and highlights the need for training and
information both for companies and for private individuals.
This is the main thrust of the communication.

C 48/34

EN

Official Journal of the European Communities

21.2.2002

2.6.
The communication also focuses on the key objective
of protecting the privacy and confidentiality of citizens’ and
consumers’ individual data.

the free circulation of information and the open exchange of
data, ideas and scientific findings, etc.

3. Comments by the Economic and Social Committee

3.1.5.
The Committee therefore feels that any security
measures adopted must always be in proportion to their cost,
to the type and importance of
the protected data and
operations, and to the categories of users concerned.

3.1. General comments

3.1.1.
The Committee fully agrees with the analyses and
arguments underpinning the case for a European framework
policy on network and information security. It also considers
the proposed actions to be broadly appropriate, subject to a
number of comments and specific suggestions.

3.1.2.
The Internet was not designed for electronic com-
merce, contracts, the sale of copyright material (music, images
and films), capital transfers and other financial operations
requiring specific security. Initially, it was used for military
and academic purposes, and needs were met by long-key
encryption (in the case of the military) and the unencrypted
publication of experimental findings and scientific databases.
For national security reasons, strong encryption by private
individuals was often banned until 2000 in many, largely non-
European countries, as was the export of certain programmes.
Fortunately, the Commission has given an impetus to the
development of — and trade in — the security tools that are
vital to businesses and public administrations for the on-line
transmission of confidential data.

3.1.3.
Internet use then became more widespread. It began
to be used for commercial, financial, technological and indus-
trial purposes, for entertainment, and to access pornographic
sites. Such sites currently generate substantial income and,
together with on-line games, are also the origin of major
technological developments (e.g. picture quality, high-speed
access and secure payment methods, whether anonymous or
not).

3.1.4.
The Internet is still used for all these purposes and
other uses are springing up. However, networks and the
Internet increasingly underpin the workings of society and the
economy. They play a key role in social development and
national security. They also require a level of security appropri-
ate to the type of data being transmitted and the operations
being carried out — while respecting privacy and without
compromising the very foundation of the Internet itself, i.e.

3.1.6.
The Committee broadly endorses the Commission’s
presentation of potential risks and the solutions it proposes. It
also agrees that security is a dynamic issue, which must be
adapted and adjusted constantly to match technological and
software developments and changing risks. The Committee
therefore proposes that the consultation and dialogue under-
taken in connection with this communication with businesses,
users and those responsible for network security be placed on
a permanent or regular footing. Organised civil society should
be fully involved in this process, because of the impact which
network and communication security policy has on certain
fundamental rights of citizens and on economic and social
activities and public administration.

In its recent opinions on computer-related crime (1)
3.1.7.
and child protection on the Internet (2), the Committee set out
the key principles it backs to combat unlawful or criminal
Internet use. At the same time, the Committee rejects censor-
ship, blanket surveillance and constraints on freedom of
expression and communication on the global network. The
Internet, however, is not above the law.

The Committee feels that the Commission’s consider-
3.1.8.
ations and the European strategy should focus more on the
security — in all its facets — of individual users and consumers.
Even though a virus launched against the computer of a private
individual has no major impact in terms of direct economic

(1) Opinion on the Communication from the Commission to the
Council, the European Parliament,
the Economic and Social
Committee and the Committee of the Regions — Creating a safer
information society by improving the security of information
infrastructures and combating computer-related crime (CES
1115/2001) (not yet published in the Official Journal).

(2) ESC opinion currently being drawn up on a programme for child
protection on the Internet. See ESC opinions on (i) electronic
communications networks (OJ C 123, 25.4.2001, p. 50), (ii)
electronic commerce (OJ C 169, 16.6.1999, p. 36) and (iii) the
effects of e-commerce on the single market (OJ C 123, 25.4.2001,
p. 1).

21.2.2002

EN

Official Journal of the European Communities

C 48/35

interests or collective security, it must be remembered that
some attacks are large-scale and are spread via clients’ work
stations. The media may sometimes blow such attacks out of
all proportion to the real risk involved. This greatly diminishes
grassroots confidence in the benefits and usefulness of the
Internet, and considerably impacts on the potential develop-
ment of e-commerce, and e-business in general, and on the
creation of new jobs.

Although the main aim is to protect privacy and
3.1.9.
personal data, consumers also have the right to genuinely
effective protection against improper personal profiling by spy
software (spyware and web bugs), and other means. Effective
measures are also needed to curb spamming — the sending of
massive amounts of unsolicited mail — which often also arises
out of such misuse. Intrusion of this kind is damaging to those
concerned (1).

3.1.10.
Protection of privacy must apply to all persons
engaged in economic activity and must therefore also cover
company employees and other contract workers. In-house
security rules must be negotiated by the social partners, and
the whole company must be familiar with them, in line with
the statutory provisions or case law of the Member State
concerned. In this respect, it is essential to underscore the
importance of applying such arrangements uniformly, in line
with the Nice Charter of Fundamental Rights, and also with
reference to the Recommendation on privacy of the European
guarantors and Directive 95/46/EC on the protection of
personal data.

3.1.11.
Businesses and private individuals must therefore
be given more effective legal means to make software operators
and manufacturers financially liable for serious security and
data protection lapses ascribable to them under product
liability legislation (2).

The Committee feels that the Commission should
3.1.12.
promote and also spread awareness of the benefits — in terms
of resources and protection — of open source — i.e. free
operating systems and network and communication software
which can be readily modified by users. Open-source program-
mers act quickly to remedy faults and problems, and a major

business service sector — backed by certain computer industry
giants — has grown up around this concept. Many servers
across the world operate safely and stably, on the whole, with
this software. With certain brand-name software, on the other
hand, users are sometimes inconvenienced by delays in
remedying faults, and new versions, with new functionalities,
are sometimes hastily placed on the market. Reasons of
commercial competition or the quest for novelty at any price
sometimes override a culture of security. Such a culture must
be strengthened among all writers of software — whether
commercial or free — so that it is truly integrated into
products from the design stage onwards.

3.1.13.
Hence, proprietary management systems and pro-
grammes with unpublished source codes do not provide
sufficient security and privacy guarantees. This is true in
particular in the case of Internet-based licensing registration
and patch loading (to correct errors and install updates), which
can be improperly used to gather information about customer
and server systems (architecture and content, mailing lists and
connections). The Committee feels that anything other than
simply registering the name and address of the software licence
holder in order to issue an activation key or a temporary
service access code would constitute intrusion and should be
prohibited.

3.1.14.
Free software also ensures healthy competition in
the face of monopolistic trends on the software market and
the burgeoning network services market.

The general public licence (GLP) (3) should be
3.1.15.
recognised and respected. The Committee feels that specific
approaches and rules should be worked out in the intellectual
for software and content accessible or
property context
exchangeable via the Internet. It is only too easy, for example,
to use trademark legislation to curb the freedom of opinion or
expression of consumers or employers vis-à-vis the policy or
practices of a company and its goods or services. Patent and
trademark law seems to be limited — and difficult to apply —
in the face of growing networks which, as a result, require
specific legal protection that is as yet inadequately framed.

(1) See ESC opinions on (i) electronic communications networks (OJ
C 123, 25.4.2001, p. 50), (ii) electronic commerce (OJ C 169,
16.6.1999, p. 36) and (iii) the effects of e-commerce on the single
market (OJ C 123, 25.4.2001, p. 1).
(2) ESC opinion, OJ C 117, 26.4.2000, p. 1).

(3) The general public licence recognises the intellectual property of

the author of free software.

C 48/36

EN

Official Journal of the European Communities

21.2.2002

3.1.16.
Attempts to intercept, control or steal sensitive
data are directed mainly against military, administrative and
business networks. This being so, the Committee calls on the
European institutions and all the Member States to join forces
to combat any kind of interception or attempted intrusion for
the purposes of military, industrial or commercial espionage,
which runs counter to Europe’s strategic and economic
interests.

Security measures, access surveillance, internal rules
3.1.17.
and protocols, and material redundancies (appliances with
breakdown tolerance, mirror and proxy sites, frequent and
delocalised data saving) require appropriate software and
hardware and continuous monitoring and updating by highly
qualified experts. They are thus expensive. Because of a lack
of technical information and awareness and their financial
possibilities (particularly in the case of SMEs), public undertak-
ings, private businesses and public authorities experience
major difficulties in implementing such measures. Emergency
warning teams should be well-equipped and take account of
SME needs.

3.2.

Specific comments

Thus, international legal and technological cooperation must
be developed at European level to combat serious crime and
terrorism. The Committee also made this point in its opinions
on the fight against money-laundering and computer-related
crimed (1).

3.2.1.1.3.
Under competition policy, it is also essential to
monitor the concentration and monopolisation of Internet
content (information, culture, etc.) and of the net’s various
segments. The Commission should also foster the establish-
ment of a net ‘government’ that is genuinely transparent and
more representative of the 370 million current users. The
present ‘government’ is led by a multitude of different parties,
remains focused on North America and is under the close
supervision of the United States Department of Commerce.
This applies in particular to domain name allocation and the
choice of registrars (2).

3.2.1.1.4.
To safeguard their customers’ right to privacy
and confidentiality, operators must provide effective guaran-
tees that, in line with technological developments, the tools
used for the material surveillance of their installations — and
for communication encryption — reflect the importance of
the rights to be protected as closely as possible. Operators are
also bound, among other things, by Directive 97/66/EC (3).

3.2.1. T h e

r i s k s
c o u n t e r m e a s u r e s

i n v o l v e d

a n d

p r o p o s e d

Users must also be able to encrypt — with an
3.2.1.1.5.
adequate degree of security — any sensitive data they may
transmit on the net. They are, however, largely unfamiliar with
the appropriate options and how these are applied in practice.
Enough specialists will have to be trained to meet growing
encryption and security needs.

3.2.1.1.

Protection of privacy and measures to counter
computer-related crime and espionage

3.2.1.1.1.
The Committee fully agrees with the Commission
proposal that priority must be given to the protection of
privacy and the confidentiality of individual data. Protection
of fundamental rights and of freedom of information and
communication must be at the heart of any data and communi-
cation protection strategy. The same is true of the protection
of collective interests, starting with the need to safeguard
national security and ensure that democratic institutions and
public administrations function properly. The Committee
agrees on the need to develop and adapt the tools required for
these purposes, whether that involves legislation, cooperation,
research or standardisation.

Although scope for lawful

3.2.1.1.2.
interception — in
compliance with the appropriate legal procedures — must be
maintained, strong encryption may make it impossible to
decrypt the messages. Those involved in serious crime use the
safest, most modern means to protect their communications.

Intrusion into computers and networks for what-
3.2.1.1.6.
ever reason (intellectual challenge, personal revenge or a desire
to cause harm,
information theft or take-over for various
different purposes) and the dissemination of computer viruses
jeopardise the rights and interests of users and the integrity of
data, information and networks.

(1) ESC opinion currently being drawn up on a programme for child
protection on the Internet. See ESC opinions on (i) electronic
communications networks (OJ C 123, 25.4.2001, p. 50), (ii)
electronic commerce (OJ C 169, 16.6.1999, p. 36) and (iii) the
effects of e-commerce on the single market (OJ C 123, 25.4.2001,
p. 1).

(2) Companies responsible for allocating and managing certain top-

level names.

(3) Directive on data protection in telecommunications (OJ L 24,

30.1.1998).

21.2.2002

EN

Official Journal of the European Communities

C 48/37

3.2.1.1.7.
The Committee fully agrees with the Commission
on the major damage that can be caused by various types of
intrusion, sometimes culminating in the clandestine take-over
of the system, but considers that it would be excessive to lump
together hackers — who, with no criminal intent, seek merely
to draw attention to security deficiencies that can then be
corrected — and crackers, who seek to access systems
for unlawful purposes. Any legislation proposed by the
Commission to punish offenders will have to stay in pro-
portion to the crimes and offences, which in turn must be
defined in precise and specific terms and take account of
intruders’ intentions.

3.2.1.2. Applicable Community law and available tech-

nologies

Community law requires that Member States take
3.2.1.2.1.
all necessary steps to ensure the availability of public networks
in the event of network breakdown caused by natural disasters
Interconnection Directive 97/33/EC (1) and Voice Tel-
(cf.
ephony Directive 98/10/EC (2)). However,
the Committee
would propose that the Commission undertake a comparative
study of action taken and its effectiveness in all the Member
States.

3.2.1.2.2. Misrepresentations by natural or legal persons
may cause damage and, for all major transactions, it is essential
to authenticate the party involved and ensure the veracity of
the statements made.

Thanks to SSL and IPsec,

3.2.1.2.3.
is possible to
communicate on the Internet and on open channels with some
measure of security, but this does not provide sufficient
guarantees. Under the Electronic Signatures Directive (3), such
guarantees may be provided by a third party — the ‘certifi-
cation service provider’.

it

3.2.1.2.4.
This solution poses the same problem as encryp-
tion — the need for interoperability and key management. In
a VPN (virtual private network) it is possible to resort to
proprietary solutions. On the other hand, this is a major
obstacle for public networks.

3.2.1.2.5.
For these reasons, the e-signature Directive is
the legal basis and essential tool for facilitating electronic
authentication in the EU.

(1) OJ L 199, 26.7.1997.
(2) OJ L 101, 1.4.1998.
(3) Directive 1999/93/EC of 13 December 1999 on a Community
framework for electronic signatures, OJ L 13, 19.1.2000, p. 12.

3.2.1.3. New challenges, new risks and cost-benefit analysis

3.2.1.3.1.
The Committee agrees with the analysis of the
new challenges and risks connected with the rapid growth of
technology, the multiplication and diversification of access
terminals, as well as the increased danger of piracy with the
general
introduction of always-on terminals with a fixed
address. It endorses the approach which aims to reconcile
security and freedom, network protection and protection of
privacy and confidentiality.

3.2.1.3.2. Moreover, although safer encryption called for
legislative changes to allow ‘strong encryption’, these have
sometimes come very late owing to security considerations.
But the ability to hide messages in the ‘noise’ of image or sound
files (steganography) has meant that lawbreakers wishing to
remain undetected have already been able to disguise the
sending of an encrypted message.

3.2.1.3.3.
Several algorithms are used, and more sophisti-
cated ones are becoming available. This poses serious problems
for the management of messages which have been encrypted
by different correspondents using different methods. Even the
recommendation of a European system, which may facilitate
communications in the single market, will run up against the
diversity of the systems used in the rest of the world. This
impacts on the cost of security and its management, even if
some effective systems are in the public domain and are free
of charge.

Nevertheless, the cost of non-security, now that
3.2.1.3.4.
increasingly sensitive data are circulating,
is even higher.
Security will also, to a certain extent, be incorporated more
and more into products.

3.2.1.3.5.
The Committee takes a positive view of the
European approach proposed by the Commission — while
being aware of its limits — and of the need for public action,
in order to compensate for the current shortcomings in the
market and address the important issues at stake.

3.2.1.3.6.
There are already legal guarantees in EU Direc-
tives on data protection and in the telecommunications
regulatory framework. However, these measures have to be
implemented in a rapidly changing environment of new
technologies, competition, network convergence and glo-
balisation and at a time when the market is tending to under-
invest in security for the reasons quite rightly set out in the
Communication, despite the rapid growth in the security
market throughout the world.

C 48/38

EN

Official Journal of the European Communities

21.2.2002

3.2.1.3.7.
It is true, as the Commission states, that the
security market is still imperfect. Investment in security is only
profitable if a sufficient number of people adopts the same
approach. Solutions must therefore be found through cooper-
ation. Since a host of goods and services continue to use
proprietary solutions, research into more widely accepted,
more secure standards and into the interoperability of security
systems must be encouraged. The Committee feels it would be
better to encourage the establishment of common criteria
at international level rather than certification/authentication
systems which may penalise the final consumer.

3.2.1.3.8.
Firstly, existing EU legal provisions must be
implemented efficiently. The legal framework must remain
relevant and effective, and it will thus inevitably have to be
constantly adapted.

services, applications and software products offer attractive
features, but these may be a source of new vulnerabilities.
Products should be tested more thoroughly before they are
placed on the market.

3.2.2.

S p e c i f i c c o m m e n t s o n t h e p r o p o s e d
E u r o p e a n p o l i c y f r a m e w o r k

3.2.2.1.
The Committee is aware of the intrinsic vulner-
ability of the global network, particularly as regards routing of
data packets, and of the fact that the ever increasing mass of
data in circulation does not make it possible to use filtering to
make data generally secure outside terminals. It generally
endorses the proposed actions contained in the policy frame-
work.

3.2.1.3.9.
Secondly, while market forces do not currently
make it possible to generate a sufficient level of investment in
technologies and security practice,
the political measures
proposed by the Commission could be used to bolster the
market process, which has, for that matter, started to evolve.

3.2.3. A w a r e n e s s r a i s i n g

3.2.1.3.10.
Lastly, communication services and infor-
mation are cross-border issues. This is why a European policy
approach is required to provide a single market for these
services, to benefit from common solutions, and for more
effective action at global level.

3.2.3.1.
The proposals to raise the awareness of all stake-
holders (individuals and organisations) are judicious. Making
terminals and communications secure depends mainly on
awareness raising and informed action by users themselves.

3.2.1.3.11.
The Committee concurs with the statement that
investment in improved network security generates social
costs and benefits which are not adequately reflected in market
prices. With regard to costs, market players are not currently
obliged to shoulder all the responsibilities resulting from their
security behaviour. The Committee feels that this state of
affairs cannot continue any longer.

the benefits of

3.2.1.3.12.
The Committee also endorses the view that
security benefits are no longer fully reflected in market prices,
investment made in this area by
whilst
operators, suppliers or service providers not only accrue to
their customers, but also to the economy as a whole and to
communications security in general.

3.2.1.3.13.
The Committee also endorses the idea that users
are not aware of all the security risks, whilst many operators,
vendors or service providers have difficulty in assessing the
existence and extent of vulnerabilities. Similarly, many new

3.2.4.

E u r o p e a n r a p i d i n f o r m a t i o n s y s t e m

3.2.4.1.
The Committee endorses the proposal for a Euro-
pean rapid warning and information system which lists the
problems and solutions, and the Commission’s other proposals
on analysis, early detection, dissemination of information and
advice, and European and worldwide cooperation. Throughout
the Union, suitable infrastructure for permanent and effective
cooperation is also to be developed.

3.2.4.2.
Nevertheless, with regard to the reports that would
have to be submitted by companies, and also, in the Com-
mittee’s opinion, by administrations and other bodies, the
Committee recognises that the confidentiality of the pro-
cedures for reporting attacks will encourage feedback, but
notes that hackers always leak information or make public
revelations, and relatively speedy knowledge of the nature of
the attacks or flaws and especially of the remedial action
taken would, if anything, be instrumental in gaining public
confidence.

21.2.2002

EN

Official Journal of the European Communities

C 48/39

3.2.4.3.
The Committee feels that the detection and warn-
ing systems should also cover fault discovery in commercial
or free software and any technological or other factor which
could open the door to possible attacks. The early analysis
system could take on this role, keep abreast of technological
innovations, and monitor hackers and pirate sites and various
underground publications which deal with the methods avail-
able, or even publish ‘turnkey’ virus creation or intrusion
programmes which are used by script kiddies (1).

That said,

the publication of

3.2.5.3.
findings without
informing those directly involved well in advance and without
their consent is a reprehensible and punishable act. However,
efforts should be made to legalise the acts of people who
commit no crime or serious offence and cause no financial
damage, and to turn their skills to good account for the benefit
of society. This would prevent these rare skills from being
exposed to the risk of improper, criminal or terrorist use, as
would be the case if they remained maginalised and outside
the law.

3.2.5. T e c h n o l o g y s u p p o r t

3.2.6.

S u p p o r t
a r d i s a t i o n a n d c e r t i f i c a t i o n

f o r m a r k e t - o r i e n t e d s t a n d -

3.2.5.1.
The Committee endorses the support proposals for
research. It would point out, however, that no more than a
few dozen experts in the world are skilled in the science of
cryptography, and many of them work for the NSA (2). How
can we retain the European experts to develop research? Which
methods would be effective in Europe? The NSA is 10 or
15 years ahead and has calculation (and decoding) methods
which seem to be difficult to match over a short space of time.
What specific — and necessarily large-scale — funding will be
provided for research (3)?

The possibility of accepting hackers and ‘informal’
3.2.5.2.
experts could also be explored as an alternative to the ‘cold
shoulder’ approach that appears to be emerging in Europe,
where people causing no direct damage either to others or to
society are being marginalised or over-penalised for acts which
are wrongly assumed to be very serious. Penalties must be in
place to deter acts of piracy or terrorism on the networks.
However, research into security lapses undertaken to provide
information for software writers or network managers for the
purpose of improving protection should not, as a matter of
course, be placed in the same category provided there is no
evil intent such as sabotage, the hijacking of confidential data,
secret network use, personal gain or the spread of computer
viruses.

(1) Young learner ‘pirates’ with no technical qualifications who merely
copy what they find on underground sites and publications.

(2) US National Security Agency.
(3) ESC opinion on the sixth RTD framework programme (OJ C 260,

17.9.2001, p. 3).

3.2.6.1.
The Committee shares the Commission’s view that
there are too many competing standards and systems — which
consequently impede security and the progress of e-signature
and secure electronic payments — and stresses the need for
common standards, common criteria for avoiding market
rigidities, and interoperability.

3.2.6.2.
The Committee endorses the proposed actions, but
would highlight certain difficulties inherent in the private and
insufficiently representative nature of the current ‘government’
of the Internet, which among other things, sets the standards.
This will be long-term work, which will require patience and
cooperation.

3.2.7.

L e g a l f r a m e w o r k

3.2.7.1.
for networks and the Internet
framework for telecommunications and data protection.

The Committee approves the draft specifications
in the existing legislative

3.2.7.2.
The proposed actions are judicious, and the Com-
mittee endorses the planned initiatives to provide for harmon-
ised criminal law and to strengthen cooperation in the field of
criminal law between Member States on cyber-crime, without
prejudicing the liberalisation of trade in powerful encryption
tools, which are the only ones likely to ensure effective
security. Cooperation in civil and commercial matters also
plays a key role in combating cyber-criminals (financial
circuits, tax fraud etc.).

C 48/40

EN

Official Journal of the European Communities

21.2.2002

However, cooperation in criminal law should, in
3.2.7.3.
the Committee’s view, extend to the global
level, and the
European strategy in this area should be provided with
an action line within the proposed policy framework. The
Committee is pleased to note that the Commission is expected
to issue a formal proposal on this issue in the coming weeks.

appropriate body for international cooperation on this front.
It is vital to attain practical results at global level.

3.2.9.4.
The Committee backs what it sees as the very
important Commission proposal to set up a European-level
forum bringing together all the relevant players, to debate the
full range of issues involved and to put forward solutions to
the institutions.

3.2.8.

S e c u r i t y i n g o v e r n m e n t u s e

The Committee approves the planned actions, in
3.2.8.1.
view of the personal nature of a significant amount of data
processed by public administrations, and also of the fact that
their sites are open to terrorist-style attacks or to attacks
motivated by domestic or foreign policy considerations, as
Red Code (a polymorphic virus) and Nimda showed recently.
This should provide the Commission with an additional reason
for making its sites and official networks, and those of the
Member States, even more secure.

3.2.9.

I n t e r n a t i o n a l c o o p e r a t i o n

4. Conclusions

4.1.
Constantly evolving software and hardware solutions
such as those described in the communication, are available
and are quite effective. Moreover the integrity of a file can also
be guaranteed by using a unique digital algorithm which shows
that the transmitted file has not been modified.

However, the Committee believes that user awareness-
4.2.
raising, information and training hold the key to any security
strategy, because without them, available procedures and
solutions will not be used correctly. They also boost confidence
in the overall reliability of the system, as long as all basic
precautions are taken regularly by all concerned, and compani-
es make the required investment in the security of their
systems.

3.2.9.1.
As the Committee sees it, this is an essential, but
delicate and difficult pillar of the European network and
communications security policy which poses serious problems
in terms of internal solidarity, external policy, joint security,
and governance of interconnected networks and the Internet.

4.3.
But the cost of security is very high, and the lack of
interoperability of the solutions is a major obstacle. An open
source solution could provide an input by promoting both
competition and emulation.

The proposal for action in this field, which aims
3.2.9.2.
to further cooperation between the various international
authorities on network reliability, is diplomatically worded so
as not to cause offence.

4.4.
These problems, if not solved quickly within Europe
and internationally — and Europe must play an effective role
in the ‘government’ of the Internet — will continue to hinder
development of e-Europe, e-commerce and the management
of companies, public services and administrations.

3.2.9.3.
However, the Committee feels it would also be
advisable for the appropriate international authorities and the
transatlantic dialogue to continue to address issues of security;
interoperability of keys and encryption systems and the
problem of any possible weakness in some standards which
may be known but not revealed by a particular party. It would
also be desirable to work together closely on issues such as the
international circulation of personal data, and legal and
civil cooperation on cyber-crime, i.e. effective security and
transparent, balanced management of the global network,
whose strategic importance is now recognised as essential to
the life and well-being of our societies. The OECD, which
is, among others, an
works on network security issues,

4.5.
In any event, it is essential for the sake of network
security to achieve widespread implementation of effective and
proportionate protective and defence measures, whether they
be software solutions for private individuals (regular antivirus
updates) or combined and somewhat more cumbersome
solutions for other users (fire walls, external communication
port monitoring, separation (DMZ) (1), shields, and other
relevant software and hardware technology).

(1) DMZ: demilitarised zone, sort of buffer zone isolating the internal

network.

21.2.2002

EN

Official Journal of the European Communities

C 48/41

4.6.
Dissuasion by appropriate criminal sanctions is within
the remit of the Member States, but the Committee feels it is
up to the Commission to propose a unifying overall framework
for the Community approach and for international
legal
cooperation.

4.7.
The marketing of certain products which might deliber-
ately contain backdoors (1) — that will sometimes take years
to detect — must be addressed and should be subject to
sanctions, as well as the spyware which is often present in
demonstration software, some free software and on-line licence
registering systems.

Even unintentional flaws take time to update, and can

4.8.
be used as backdoors by those in the know.

(1) Hidden access ports.

4.9.
Ad hoc, independent, impartial, representative national
authorities — either existing bodies, whose remit needs to be
broadened, or new bodies in places that do not yet have them
(the applicant countries, which also have to be involved)
— should monitor these security issues to help formulate
recommendations and standards, and protect basic rights. The
draft legislation in the pipeline must be looked at more
carefully in order to reconcile the essential requirements of
fighting terrorism with the principles of individual freedom
that must be maintained.

In the ESC’s opinion, the Internet must, in any event,
4.10.
remain flexible and easily accessible, and continue to provide
an outlet for freedom of information and communication in
an open, democratic society, while being more secure for the
various users, in the diverse and growing legal applications of
networks and the Internet.

Brussels, 28 November 2001.

The President

of the Economic and Social Committee

Göke FRERICHS