Council Resolution of 28 January 2002 on a common approach and specific actions in the area of network and information security
Date: 2002-01-28
Institutions: Council of the European Union
Subjects: data protection, electronic mail, information network, systems interconnection, telecommunications, transmission network

C 43/2

EN

Official Journal of the European Communities

16.2.2002

the financial

(2) to consider the possibility of a financial support to this
initiative on the basis of
interventions
provided for educational activities by Council Decision of
9 December 1999 establishing a Community action
programme in the field of civil protection (1)
the
period 1 January 2000 to 31 December 2004 or by the
said
Community
mechanism to facilitate reinforced cooperation in civil
protection assistance interventions,

Council Decision

establishing

for

a

(1) OJ L 327, 21.12.1999, p. 53.

(3) to involve the candidate countries in its work.

(4) to consider, on expiry of this pilot phase and in the light of
the results obtained, any initiative introducing long-term
cooperation on civil protection training,
instance
through the creation of a European civil protection
college which would institutionalise the aforementioned
network.

for

COUNCIL RESOLUTION

of 28 January 2002

on a common approach and specific actions in the area of network and information security

(2002/C 43/02)

THE COUNCIL OF THE EUROPEAN UNION,

RESPONDING TO

the Conclusions of the Stockholm European Council of 23 and
24 March 2001 that the Council together with the Commision
will develop a comprehensive strategy on security of electronic
networks including practical implementing action,

RECALLING

1. the Resolution of the Council of 30 May 2001 (cid:151) eEurope

Action Plan: Information and Network Security;

2. the Communication from the Commission to the Council,
the European Parliament,
the European Economic and
Social Committee and the Committee of the Regions (cid:151)
Network
a
European Policy Approach;

and Information Security:

Proposal

for

3. the Communication from the Commission to the Council
and the European Parliament (cid:151) eEurope 2002: Impact and
priorities;

4. the eEurope 2002 Action Plan endorsed by the Feira

European Council of 19 and 20 June 2000;

5. Council Recommendation 95/144/EC of 7 April 1995 on
evaluation

common information technology
criteria (1);

security

7. the Communication from the Commission on creating a
information

safer society by improving the security of
infrastructures and combating computer related crime;

8. Regulation (EC) No 45/2001 of the European Parliament
and of
the Council of 18 December 2000 on the
protection of individuals with regard to the processing of
personal data by the Community institutions and bodies
and on the free movement of such data (3);

9. Directive 95/46/EC of the European Parliament and of the
Council of 24 October 1995 on the protection of indi-
viduals with regard to the processing of personal data
and on the free meovement of such data (4);

10. Directive 97/33/EC of the European Parliament and of the
Council of 30 June 1992 on interconnection with telecom-
munications with regard to ensuring universal service and
interoperability through application of the principles of
open network provision (ONP) (5);

11. Directive 97/66/EC of the European Parliament and of the
Council of 15 December 1997 concerning the processing
of personal data and the protection of privacy in the tele-
communications sector (6);

12. Directive 98/10/EC of the European Parliament and of the
Council of 26 February 1998 on the application of open
network provision (ONP)
to voice telephony and on
universal service for telecommunications in a competitive
environment (7);

6. the Council Recommandation of 25 June 2001 on contact
service for combating

points maintaining a 24-hour
high-tech crime (2);

(1) OJ L 93, 26.4.1995, p. 27.
(2) OJ C 187, 3.7.2001, p. 5.

(3) OJ L 8, 12.1.2001, p. 1.
(4) OJ L 281, 23.11.1995, p. 31.
(5) OJ L 199, 26.7.1997, p. 32.
(6) OJ L 24, 30.1.1998, p. 1.
(7) OJ L 101, 1.4.1998, p. 24.

16.2.2002

EN

Official Journal of the European Communities

C 43/3

13. Directive 1999/93/EC of the European Parliament and of
the Council of 13 December 1999 on a Community
framework for electronic signatures (1);

WHEREAS:

(1) Networks and communication systems have become a key
factor in economic and social development and their
availability and integrity is crucial
infra-
structures, as well as to most public and private services
and the economy as a whole.

to essential

(2) In the light of the increasingly important role played in
the economy by electronic services,
the security of
networks and information systems is of growing public
interest.

supply

(3) The security of transactions and data has become essential
including
for
the
e-commerce
low
and
confidence in security could slow down the widespread
introduction of such services.

electronic
and online public

services,
services,

of

(4) There is a need for

individuals, businesses, adminis-
their own
trations, and other organisations to protect
by
and
information,
deploying effective security technologies, where appro-
priate.

communication systems

data

(5) The private sector, acting in a competitive market
environment, and through its capacity to innovate offers
a variety of solutions adapted to genuine market needs.

(6) The complex nature of network and information security
means that in developing policy measures in this field,
public authorities must
take into account a range of
political, economic, organisational and technical aspects,
and be aware of the decentralised and global character of
communication networks.

(9) There are legal requirements imposed on providers of
telecommunications
appropriate
services
technical and organisational measures to safeguard the
security of their services; these measures shall ensure a
level of security appropriate to the risk represented.

take

to

(10) The international standard ISO-15408 (Common criteria)
has become a recognised system for defining security
requirements for computer and network products and
evaluating whether a particular product meets
those
requirements.

(11) The international standard ISO-17799 (Information tech-
information security
nology (cid:151) Code of practice for
management)
are
guidelines
and
becoming recognised practice for security management
in private and public organisations.

national

similar

(12) Internet infrastructure should permit a high degree of
access to networks and services, and be managed and
operated in a robust and secure manner, e.g. by the
adoption of open standards
security
protocols;

and internet

CONSIDERING, in line with Council Resolution of 30 May 2001
on the (cid:145)eEurope Action Plan:
Information and Network
Security(cid:146), that network and information security is about

(cid:151) ensuring the availability of services and data,

(cid:151) preventing the disruption and unauthorised interception of

communications,

(cid:151) confirmation that data which has been sent, received or

stored are complete and unchanged,

(cid:151) securing the confidentiality of data,

(cid:151) protection of

information systems against unauthorised

access,

(cid:151) protecting against attacks involving malicious software,

(7) Policy measures can be more effective if they are part of a
European approach, respect the effective functioning of
the Internal Market, build on increased cooperation
between Member States and internationally, and support
innovation and the ability of European enterprises to
compete at global level.

(cid:151) securing dependable authentication;

THEREFORE ASKS THE MEMBER STATES

(8) A substantial body of legislation relevant to network and
information security is already in place, notably as part of
the Union’s legal framework for telecommunications, elec-
tronic commerce and electronic signatures.

(1) OJ L 13, 19.1.2000, p. 12.

1. by the end of 2002 to launch or strengthen information and
education campaigns to increase awareness of network and
information security; to specifically target such actions at
business, private users and public administrations;
to
develop such awareness raising actions closely with the
private sector, including inter alia internet service providers,
and to encourage private sector-led initiatives;

C 43/4

EN

Official Journal of the European Communities

16.2.2002

2. to

best

promote

practices

security
management notably in small and medium sized enterprises
based, where appropriate, on internationally recognised
standards;

information

in

3. by the end of 2002 to strengthen or promote the
security concepts as part of computer

importance of
education and training;

regarding computer

4. by mid 2002 to review the effectiveness of national
arrangements
response,
which could include virus alert systems, with a view to
strengthening, where necessary,
their ability to prevent,
detect, and react efficiently at national and international
level against network and information systems disruption
and attack;

energency

5. to promote the use of

the common criteria standard
(ISO-15408) and to facilitate mutual recognition of related
certificates;

6. by the end of 2002 to take significant steps towards
effective and interoperable security solutions based on
recognised standards where possible (cid:151) which could
include open source software (cid:151) in their e-govemment
and e-procurement activities, and towards the introduction
of electronic signatures to allow those public services that
require strong authentication also to be offered on-line;

7. where they choose to introduce electronic and biometrics
identification systems for public or official use, to cooperate
where appropriate on technological developments and to
examine any possible interoperability requirements;

8. with a view to facilitating Community and international
cooperation, to exchange information with each other and
with the Commission on the bodies primarily responsible
within their territory for network and information security
matters;

the

increasing dependency on electronic
cations of
communication networks; and in this context to propose,
by the end of 2002, a strategy for a more stable and secure
operation of the Internet infrastructure;

3. by the end of 2002 to propose adequate measures to
promote the ISO 15408 (Common Criteria) standard, to
facilitate mutual recognition of certificates, and to improve
the process by which products are evaluated,
i.e. by
developing adequate protection profiles;

4. by the end of 2002 to prepare a report on technologies and
applications of electronic and biometric authentication of
identity with a view to improving the effectiveness of
such systems, in particular through interoperability;

5. by mid 2002 to make proposals (cid:151) after consultation with
the Member States and the private sector (cid:151) for the estab-
lishment of a cyber-security task force to build on national
efforts to both enhance network and information security
and to enhance Member States’ ability,
individually and
collectively, to respond to major network and information
security problems;

6. by the end of 2002,

to explore,

in collaboration with
Member States,
the possible options for mechanisms by
which Member States and the Commission can exchange
information and experience on their achievement of the
objectives of this Resolution, taking into account the cross-
pillar dimension of network and information security, and
to explore how the private sector can be best involved in
this exchange of information and experience;

WELCOMES the increased focus of European research activities
on security matters;

STRESSES the need for more research activities, in particular on
security mechanisms and their interoperability, network relia-
bility
privacy
advanced
enhancement technologies and security in wireless communi-
cations;

cryptography,

protection,

and

WELCOMES THE INTENTION OF THE COMMISSION

CALLS UPON

1. in 2002 to facilitate an exchange of best practice regarding
and to draw up an initial

awareness-raising actions
inventory of the various national information campaigns;

2.

in 2002 to make proposals to reinforce the Community’s
dialogue and cooperation with international organisations
and partners on network security, in particular on the impli-

(cid:151) suppliers and service providers to strengthen security as an
integral and essential part of their products and services;

(cid:151) the European private sector suppliers and service providers
representative groupings to participate more
and their
and
actively in international
organise themselves into appropriate fora to contribute to
the objectives of this resolution.

standardisation activities