European Parliament recommendation to the European Council and to the Council on the protection of critical infrastructure in the framework of the fight against terrorism (2005/2044(INI))
Date: 2005-06-07
Institutions: European Parliament
Subjects: civil defence, common security and defence policy, exchange of information, public safety, terrorism

C 124 E/250

EN

Official Journal of the European Union

25.5.2006

Tuesday 7 June 2005

P6_TA(2005)0221

Protection of critical infrastructure

European Parliament recommendation to the European Council and to the Council on the protec-
tion of critical infrastructure in the framework of the fight against terrorism (2005/2044(INI))

The European Parliament,

— having regard to the proposal for a recommendation to the Council by Stavros Lambrinidis on behalf
infrastructures in the framework of the fight against

of the PSE Group on protection of critical
terrorism (B6-0085/2005),

— having regard to the Constitutional Treaty, and in particular to Articles III-284 on civil protection and
I-43, which provides that ‘The Union and its Member States shall act jointly in a spirit of solidarity if a
Member State is the object of a terrorist attack or the victim of a natural or man-made disaster,’

— having regard to the Declaration on solidarity against terrorism adopted by the Heads of State and

Government on 25 of March 2004,

— having regard to the ‘Hague Programme’ (1) adopted on 5 November 2004, according to which ‘…
effective management of cross-border crises within the EU requires not only the strengthening of the
current actions on civil protection and vital infrastructure but also addressing effectively the public
order and security aspects of such crises … Therefore the European Council calls for the Council and
the Commission to set up … an integrated EU crisis management arrangement … to be implemented
at the latest by 1 July 2006. This arrangement should at least address the following issues: further
assessment of Member States “capabilities, stockpiling, training, joint exercises and operational plans
for civil crisis management”,’

— having regard to the Commission communications:

a) to the European Parliament, the Council, the European Economic and Social Committee and the
Committee of the Regions on Reinforcing the civil protection capacity of the European Union
(COM(2004)0200), which evaluates the results so far achieved with, the weaknesses of, and possible
improvements to, the European Union's civil protection capacity, notably as a first instrument on
crisis intervention, founded on a voluntary basis,

b) to the Council and the European Parliament on Prevention, preparedness and response to terrorist
attacks (COM(2004)0698), which emphasises the need for an integrated Community approach that
should, inter alia, focus on proper communication of authorities with the public in case of a crisis,
on the role of EUROPOL in the creation of a law enforcement alert mechanism to deal with
terrorism and the establishment of a European Programme for Critical Infrastructure Protection
(EPCIP), on security research, and on engaging in a structured manner the relevant parts of the
private sector,

c) to the Council and the European Parliament on Preparedness and consequence management in the
fight against terrorism (COM(2004)0701), which proposes to consolidate the emergency systems
managed by the Commission in a secure general rapid alert system (ARGUS) linked to a Central
Crisis Centre that would bring together representatives of all relevant Commission Services and
would provide a permanent link between the Member States and the European Institutions,

d) to the Council and the European Parliament on Critical Infrastructure Protection in the fight against
terrorism (COM(2004)0702), which proposes an EPCIP to be established in cooperation with the
Member States and the relevant parts of the private sector and which will identify the possible short-
comings and the corrective measures (legal or of other kinds) to be taken,

(1) Updated on 17 December 2004 on the specific issue of fighting terrorism.

25.5.2006

EN

Official Journal of the European Union

C 124 E/251

Tuesday 7 June 2005

— having regard to its resolution of 4 September 2003 on the effects of the summer heat wave (1), in

which it called for a European Civil Protection Force to be created,

— having regard to the relevant legal bases in the Treaties which empower the Community and the Union
to define and implement policies for supporting Member State action in protecting the health, security
and safety of European citizens,

— having regard to Rule 114(3) and Rule 94 of its Rules of Procedure,

— having regard to the report of

the Committee on Civil Liberties,

Justice and Home Affairs

(A6-0161/2005),

A. conscious of the continuing need of Europe's citizens to be protected against the risks linked with
terrorist attacks (such as nuclear, radiological, chemical and biological, attacks in public spaces, etc.) but
also with natural disasters (such as earthquakes, floods, fires, forest fires), with technological disasters
(such as Seveso, maritime disasters, transport accidents), as well as with health and other crises (e.g.,
pandemics), in the context of an integrated European strategy, given that such events not only often
have major cross-border consequences at a European level, but also make it necessary for the Member
States to demonstrate solidarity with one another and for there to be in place a consistent and inter-
operable system of response,

B. noting that an effective strategy should focus both on preparedness (risk and threat assessments on
infrastructure, heightened security measures, promoting common security standards and
critical
exchange of expertise, promoting EU-wide coordination and cooperation) and on managing the conse-
quences of attacks and disasters (exchange of know-how and experience, scenario-building and training
exercises and establishment of appropriate crisis-management, rapid-alert and civil-protection mechan-
isms),

C. convinced that, especially in the case of terrorism, when prevention and deterrence are undermined and
attacks occur, only a well-organised and effective response system can guarantee an expeditious return
to normality; only by increasing specialised skills, working closely together, pooling resources, guaran-
teeing risk assessment,
training, communications and pre-emptive and post-disaster
analysis, ensuring a prompt restoration to normality and, finally, by increasing funding and protecting
victims with the necessary aid, can the Member States and the EU be better prepared to protect citizens
when a disaster strikes within and outside the Union, with real or imminent consequences for EU citi-
zens,

information,

D. noting that critical

infrastructure in the EU is becoming highly interconnected and interdependent,

making it more vulnerable to disruption or destruction,

E.

recognising that to protect critical infrastructure requires a consistent, cooperative partnership between
the owners and operators of such infrastructure and Member State authorities; noting that analysing
and managing risk in each infrastructure must be based on strict EU-set processes and standards; noting
that the responsibility of managing risk within physical facilities, supply chains, information technolo-
gies and communication networks ultimately rests with the owners and operators who are in charge of
the day to day running of those infrastructures; noting, however, that the EU and Member States
should assist, instruct, support and monitor industry at all levels of public authority, including through
financial and other incentives, as and when appropriate, to perform their obligations; noting, in this
regard, that operators should be able to forward existing information to the authorities and that the
latter take responsibility for analysing the information and devising appropriate security solutions in
conjunction with the operators; whereas it is vital that the fundamental right to data protection is
ensured at European and national levels in each individual case linked with these activities,

(1) OJ C 76 E, 25.3.2004, p. 382.

C 124 E/252

EN

Official Journal of the European Union

25.5.2006

Tuesday 7 June 2005

F. convinced of the need to strengthen computer protection systems in cooperation with European (e.g.
ENISA) and national competent authorities in the face of an ever more sophisticated threat, by making
use of leading-edge information technologies,

1.

Addresses the following recommendations to the European Council and to the Council:

a) implement in full the European Council proposal to establish an ‘integrated EU crisis management
arrangement’ as an essential element in reinforcing the links between the citizens and the EU institu-
tions and strengthening interdependence and solidarity between the Member States;

b) ensure that an integrated European strategy particularly addresses the threat to critical infrastructure,
including computer facilities, the disruption or destruction of which would have a serious impact on
the health, safety, security or economic well-being of citizens, and to establish a harmonised EU
method so that Member States and operators can, through common standards and the organisations
and persons in charge of security: identify critical infrastructure, analyse the vulnerability and interde-
pendence thereof and the transboundary effects of crises and conduct the relevant threat assessments;
and devise solutions to protect such infrastructure, prepare it for all hazards and provide an adequate
response in the event of an attack or disaster occurring;

c) establish, on a proposal from the Commission and subject to Parliament's approval, a European
Programme for Critical Infrastructure Protection (EPCIP) which should be financed by the Member
States and/or by the owners and operators, on the basis of financial or other incentives, as and where
appropriate; the Member States taking part should ensure that cooperation takes place,
including
public-private cooperation, and that there are the data and human and logistical resources needed for
the various phases of the project, to meet the requirements of proportionality and subsidiarity, with
particular regard to civil rights, data protection and security requirements;

d) take on board the fact that the EPCIP should be considered by the Member States' law enforcement
agencies and those responsible for national civil protection mechanisms as complementary to national
planning and awareness raising; that the success of the EPCIP should be evaluated independently and
by specific standards; and that, on a proposal from the Commission, the Council should establish the
EPCIP via an identifiable and achievable calendar of gradual implementation of specific and clearly
defined steps and goals; and to recognise that, to be successful, a European Critical Infrastructure
Early-Warning Information Network should assist in stimulating an exchange of information on shared
threats and mutual vulnerability and devising appropriate measures and strategies to mitigate risk, in
support of protecting critical infrastructure;

e) take on board the fact that:

— a European risk-analysis system should be created bearing in mind the data protection exigencies at
European and national levels in cooperation with the European Data Protection Supervisor so as to
ensure interoperability;

— there should be coordination between all the relevant authorities at national, European and interna-
tional level which share information, which should include the data protection authority at the
respective level;

— relevant information should be handled accurately, reliably and, if necessary, confidentially, what-
ever its source (military or civil
intelligence, police cooperation); the appropriate parliamentary
scrutiny should be ensured, through a specific inter-institutional agreement for this purpose when
European internal security issues are at stake;

25.5.2006

EN

Official Journal of the European Union

C 124 E/253

Tuesday 7 June 2005

— it is necessary to create within the Commission a European early-warning system for crises to inter-
link the existing European, national and international specialised early-warning systems for emer-
gencies, so that all relevant information which might require action at European level can be
shared effectively through a central network (ARGUS);

— it is advisable to associate the European Committee for Standardisation (CEN) when sectoral stan-

dards do not exist or where international norms have not yet been established;

f) ensure that the EPCIP is:

— under continuous parliamentary scrutiny at European and national levels;

— an essential element of future developments at continental and world level (1);

g) improve, as a complementary measure, the functioning of the European Solidarity Fund (for interven-

tion within the Union) and ECHO (for external interventions);

h) take over the proposal made in its abovementioned resolution to establish a European Civil Protection
Force that would be able to monitor areas at risk of natural disasters in order to prevent the occurrence
of disasters with enormous losses of human life, teams from which would intervene in events such as
the recent tsunami catastrophe, wearing a common insignia so as to enhance the visibility of European
solidarity;

i) strengthen social partnership by coordinating NGOs, civil society and local authorities;

j) ensure that alerts, advisories, and information notes, issued to help public and private stakeholders
protect key infrastructure systems, as well as any alerts and advisories addressed to the general public
in the context of civil protection emergencies, should be tailored to be absolutely necessary and appro-
priate so as not to unduly disrupt the daily lives of citizens and businesses or to create unnecessary
fear or insecurity in the population;

k) ensure respect of privacy rights, so that consumers and operators can have confidence that information
will be handled confidentially, accurately and reliably, and that business classified information will be
properly managed and protected from unauthorised use or disclosure;

l) ensure that a European data protection and retention framework is simultaneously devised as soon as
possible with relevant rules to be strictly applied in all fields and that the protection of fundamental
rights of citizens is guaranteed;

m) ensure that training exercises to enhance the Union's civil protection and critical infrastructure protec-
tion capabilities will deal with realistic and up-to-date scenarios, drawing upon the experience and
expertise of appropriate Member State specialists in civil protection and critical infrastructure protec-
tion (e.g. civil protection and critical infrastructure protection experts and scenarios from the Athens
2004 Olympic Games);

2.
Instructs its President to forward this recommendation to the European Council and to the Council
and, for information, to the Commission, the governments and parliaments of the Member States, the
Council of Europe, and the UN and its specialised agencies.

(1) See the proposal for reform of the strategy on civil protection and chemical, biological, radiological and nuclear

threats discussed at UN level.