WRITTEN QUESTION E-0181/04 by Charlotte Cederschiöld (PPE-DE) to the Commission. Network and information security.
Date: 2004-01-29
Institutions: European Parliament, Provisional data
Subjects: European Union Agency for Cybersecurity, computer network, data protection, international standard, product safety, software, standardisation

3.4.2004

EN

Official Journal of the European Union

C 84 E/765

The United Nations Framework Convention on Climate Change (UNFCCC) was adopted in New York on
9 May 1992. It has been ratified by over 180 countries. The Kyoto Protocol, adopted on 11 December
1997, complements the Framework Convention and sets reduction targets for 39 industrialised countries
(the so-called Annex I countries). Its entry into force is dependent on ratification by at least 55 countries
accounting for at least 55 % of the world’s CO2 emissions in 1990. While the first criterion has already
been met (cid:1) over 120 countries have now ratified the Kyoto Protocol (cid:1) the second still needs to be
accomplished. In this context, only ratification of the Protocol by Russia, which is responsible for 17,4 %
of the world’s CO2 emissions, or the United States, responsible for 36,1 % of emissions, could swing the
balance, as the remaining countries together represent only 2,1 %.

Under the UNFCCC the Community and its Member States are committed to implementing policies to
reduce greenhouse gas emissions to meet its objective of stabilising greenhouse gas emissions at a level
that would prevent dangerous anthropogenic interference with the climate system (Article 2).

The Community has approved the Kyoto Protocol through Decision 2002/358/EC. As such, the Kyoto
protocol will, once it enters into force, become part of Community law. This Decision also contains the
Community’s and Member States’ greenhouse gas emissions reduction targets for 2008-2012. Moreover, it
requires the Community and its Member States to comply collectively with the target of an 8 % reduction.
Therefore,
instruments, binding on the Member States, aimed at
reaching its climate change commitments in a cost-effective manner including Directive 2003/87 on the
establishment of an emission trading regime. Neither the burden sharing agreement nor the EU’s emissions
trading scheme are conditional on the Kyoto Protocol’s entry into force.

the Community has adopted legal

As with any of its legislation, the Community could review Decision 2002/358/EC or Directive 2003/87
on the basis of its internal procedures, and alterations to it would have effect in Community law.

The 10 countries due to join the EU in May 2004 have all ratified the Kyoto Protocol, and the eight of
them which are listed in Annex I (industrialised countries) have each been set a target on that basis (cid:1)
depending on the country, the required reduction ranges from 6 % to 8 %. No targets have been set for
Malta or Cyprus, which are not listed in Annex I. However, Annex III to Directive 2003/87/EC contains
precise and objective criteria for allocating them pollution rights in the market which will start operating
on 1 January 2005 (criteria 2 to 11 apply to them). Accordingly, all 25 Member States will operate in the
pollution rights market provided for by Directive 2003/87/EC. It should also be noted that the 8 %
reduction target set for the European Community only applies to the 15 current Member States. This
situation will not alter after enlargement, as the 10 future members will not be included in the Kyoto
Protocol’s ‘EU bubble’ but will continue to be subject to the targets set for them when they ratified the
Protocol.

(1) OJ L 242, 10.9.2002.
(2) Directive 2003/87/EC of the Parliament and of the Council of 13 October 2003 establishing a scheme for green

house gas emission allowance trading within the Community and amending Council Directive 96/61/EC.

(2004/C 84 E/0860)

WRITTEN QUESTION E-0181/04

by Charlotte Cederschiöld (PPE-DE) to the Commission

(29 January 2004)

Subject: Network and information security

In this time of ever-increasing threats to our information security, does the Commission see the value of an
internationally recognised, independent method of evaluating and certifying the security of information
communications technology (ICT) products? Does the Commission agree that the ‘Common Criteria’
provide such a method, and is it aware that the Common Criteria have been recognised by major countries
in Europe, North America, and elsewhere, but that they have not yet been adopted by all Member States,

C 84 E/766

Official Journal of the European Union

EN

3.4.2004

and are not being considered by all Member States during the procurement of ICT products? Has the
Commission considered how the European Network and Security Agency can promote further European
uptake of the Common Criteria?

(2004/C 84 E/0861)

WRITTEN QUESTION E-0182/04

by Charlotte Cederschiöld (PPE-DE) to the Commission

(29 January 2004)

Subject: Network and information security

Does the Commission agree that ICT products should be designed with specific security standards in mind,
and with the goal of being evaluated and certified as having an internationally recognised level of security?
If so, how can the European Network and Information Security Agency use the ‘Common Criteria’ to
promote this goal?

(2004/C 84 E/0862)

WRITTEN QUESTION E-0183/04

by Charlotte Cederschiöld (PPE-DE) to the Commission

(29 January 2004)

Subject: Network and information security

Information technology security continues to be an area where the Commission and other EU-level bodies
must take care to protect their internal systems. Does the Commission agree that the ‘Common Criteria’
provide internationally accepted standards for judging the security of ICT products and, if so, how can the
European Network and Information Security Agency use the Common Criteria when procuring its own
products and providing procurement guidance to EU and Member State bodies?

Joint answer
to Written Questions E-0181/04, E-0182/04 and E-0183/04
given by Mr Liikanen on behalf of the Commission

(10 March 2004)

With regard to network and information security standardisation and on Common Criteria in particular,
the Commission has contributed throughout the whole process of the development of Common Criteria
ever since the work with the predecessor, ITSEC, in 1991. The Commission has also worked with Member
States in defining the Mutual Recognition Agreement of the Common Criteria standard ISO/IEC 15408.

is also mentioned by the
The European Network and Information Security Agency (ENISA),
Honourable Member as a possible vehicle for promoting this standard further in Europe, is about to start
its operations within the coming months. The Commission is presently contributing to the drafting of the
ENISA’s work programme. In this reply the Commission suggests some tasks related to standardisation for
ENISA, but no definitive answers can, at this stage, be given as to what ENISA’s coming work programme
will look like.

that

From the Commission’s perspective, the use of recognised standards for evaluation and certification of ICT-
products has been an important component of the policy for network and information security. The use of
such standards in procurement activities was promoted in the Council Recommendation (95/144/EC) of
7 April 1995 (1). In the Commission Communication Network and Information Security: Proposal for A
European Policy Approach (2), the Commission emphasised the importance of security certification of
products as a key element to contribute to the users’ trust and confidence. In this respect, the Common
Criteria standard represents a solid,
internationally recognised, framework for security certification of
products. As such, it is widely used in procurement activities.