Commission staff working document - Accompanying document to the Proposal for a Council Decision on a Critical Infrastructure Warning Information Network (CIWIN) - Summary of the impact assessment {COM(2008) 676 final} {SEC(2008) 2701}
Date: 2008-10-27
Institutions: European Commission
Subjects: EU programme, industrial hazard, information network, natural disaster, public safety, terrorism

EN 

EN 

   EN 

 
COMMISSION OF THE EUROPEAN COMMUNITIES 

Brussels, 27.10.2008 
SEC (2008) 2702 

COMMISSION STAFF WORKING DOCUMENT 

Accompanying document to the 

Proposal for a 

COUNCIL DECISION 

on a Critical Infrastructure Warning Information Network (CIWIN)  

SUMMARY OF THE IMPACT ASSESSMENT 

{COM(2008) 676 final} 
{SEC(2008) 2701} 

EN 

1 

   EN 

 
  
 
 
 
 
 
 
 
On  6  June  2008,  the  Impact  Assessment  Board  of  the  European  Commission  delivered  an 
opinion regarding a preliminary version of this Impact Assessment report. In brief, it said that 
the report is written in a clear language, accessible to a non-specialist and provides a detailed 
analysis of the possible design of the system. As regards the main recommendations, it said 
that the text should be improved by describing better the existing systems for alerting Member 
States and should present the benefits of the CIWIN more clearly.  

The Board further stated that: 

•  The  baseline  scenario  should  be  developed  and  the  value  added  of  the  CIWIN  initiative 

highlighted. 

•  The document should analyse the uptake of this initiative by the Member States.  

1. 

THE CIWIN INITIATIVE 

The  Critical  Infrastructure  Warning  Information  Network  (CIWIN)  initiative  is  part  of  the 
European  Programme  for  Critical  Infrastructure  Protection  (EPCIP),  and  is  concerned 
specifically  with  the  information-sharing  process  between  EU  Member  States  and  an 
information technology system to support this process. The establishment of CIWIN was put 
forward  in  the  Communication  on  the  EPCIP  (COM  (2006)  786  final),  which  set  out  the 
horizontal  framework  for  the  protection  of  critical  infrastructures  in  the  EU,  comprising 
measures to facilitate the implementation of EPCIP, including CIWIN.  

The creation of CIWIN has already been endorsed in the Council conclusions on “Prevention, 
Preparedness  and  Response to Terrorist Attacks” and the  “EU  Solidarity  Programme on the 
Consequences of Terrorist Threats and Attacks” adopted in December 2004.1 

The main problems in the present situation are:  

•  the need for a more detailed assessment of how to protect EU critical infrastructure; 

•  the need for improved co-operation and exchange of information on critical infrastructures 

between EU Member States;  

•  duplication of activities; 

•  insufficient trust and willingness of stakeholders to exchange sensitive information. 

2. 

OBJECTIVES  

The  concrete  issue  which  requires  action  at  EU  level  is  to  facilitate  the  exchange  of 
information between Member States’ authorities (e.g. on best practices), and enable them to 
use the rapid alert system on critical infrastructure protection (CIP).  

The objective of CIWIN is to help improve CIP in the EU and facilitate co-ordination and co-
operation for information on CIP at EU level.  

1 

14894/04 

EN 

2 

   EN 

                                                 
The CIWIN operational objectives are:  

•  to provide an IT tool that will help those Member States that wish to co-operate to do so;  

•  to  offer  an  efficient  and  quick  alternative  to  often  time-consuming  methods  of  searching 
for  information,  i.e.  create  a  type  of  “one-stop-system”  for  all  relevant  information  on 
critical infrastructures in the EU;  

•  to ensure that shared information is secure;  

•  to  enable  Member  States  to  communicate  directly  and  upload  whatever  information  they 

deem relevant. 

Since  some  of  the  Member  States  would  prefer  to  use  only  some  of  the  functionalities  that 
CIWIN  offers,  one  of  the  main  operational  objectives  is  to  identify  a  solution  that  would 
allow Member States an opt-in/opt-out possibility on certain aspects of the system.  

3. 

POLICY OPTIONS 

The Impact Assessment proposes five main policy options. 

No policy option  

Under  this  option  no  horizontal  action  would  be  taken  at  European  level  and  the  Member 
States would be left to address the issue individually.  

CIWIN as an upgrade of existing Rapid Alert Systems (RAS) 

Under  this  option  CIWIN  would  represent  an  upgrade,  integrating  the  existing  RAS  into  a 
cross-sectoral RAS on critical infrastructure, available to a broader spectrum of stakeholders 
than just emergency services. However, this option would not allow the exchange of generic 
information and best practices. 

CIWIN as an open platform for the (unsecured) exchange of CIP related information  

Under this option an IT tool would be would be established and opened to the general public. 
This  would  undoubtedly  help  to  raise  awareness  on  CIP  in  Europe  and  increase  direct 
information exchange among the stakeholders.  

CIWIN as a secure voluntary/opt-in multi-level communication/alert system composed of two 
distinct functions: a rapid alert system and an electronic forum for the exchange of CIP ideas 
and best practices 

Under this option, CIWIN would be established as an IT tool equipped to contain and transmit 
sensitive information, classified up to the level of UE RESTREINT. The system would have 
two main functions: (1) a secure forum for the exchange of information, with strong emphasis 
on the exchange of best practices, dialogue and the building of trust at EU level; (2) a rapid 
alert system for critical infrastructure. Member States would be free to use the entire system, 
to choose between the functions offered, or not to use the system at all.  

EN 

3 

   EN 

CIWIN as a compulsory multi-level communication/alert system with two distinct functions: 
a rapid alert system and an electronic forum for the exchange of CIP ideas and best practices 

Under this option, CIWIN would be a compulsory system, where each Member State would 
be obliged to upload and update the relevant information regularly.  

4. 

BENEFITS AND DRAWBACKS OF THE POLICY OPTIONS 

Policy options 

Option 1: no policy change 

Advantages 

No  additional 
proposal; 

legislative 

remain 
Member  States 
completely  free  to  address 
CIP issues as they see fit 

Option  2:  upgrade  of  existing 
RAS 

cross-sectoral  RAS 

A 
would be established. 

Option  3:  open  platform  for 
the  (unsecured)  exchange  of 
information 

Wide 
information. 

access 

to  CIP 

The private sector would be 
able  to  contribute  to  the 
platform directly. 

the 

While 
information 
included  in  the  system  is 
already  publicly  available, 
CIWIN 
offer 
efficient,  co-ordinated  and 
easy access to it. 

would 

Drawbacks 

dialogue 

and 
The 
information 
sharing 
between  Member  States 
would remain the same. 

be 

secure 

There  would 
coherent, 
efficient 
exchanging 
information in Europe. 

system 

IT 

no 
and 
for 
CIP 

No  impact  on  improving 
EU security.  

No  assurances 
stakeholders 
relevant 
Europe  have  access 
relevant CIP information.  

that  all 
in 
to 

High  cost  of  ensuring  the 
inter-operability  of  existing 
RAS. 

The option would not allow 
the exchange of information 
and  best  practices.  A  new 
platform  for  the  exchange 
of  information  would  have 
to be established anyway. 

The information included in 
the system will be limited to 
non  classified  information 
only. As such information is 
already available, the added 
value  of  such  option 
is 
limited. 

No possibilities to exchange 
alerts. 

Option  4:  secure  and  opt-in 

The  system  would  offer  a 

The  stakeholders  from  the 

EN 

4 

   EN 

private  sector  would  not 
to 
have 
CIWIN.  

access 

direct 

The  success  of  the  system 
will depend on the Member 
States’ willingness to use it.  

multi-level system  

secure  environment  for  the 
information 
exchange  of 
and contribute significantly 
to  building 
trust  among 
stakeholders. 

The  information  included 
will  go  beyond  what  is 
already publicly available. 

The  system  would  enable 
alerts to be exchanged. 

CIWIN  would  offer  an 
efficient,  easy  to  use  IT 
system. 

CIWIN would contribute to 
increasing  security  in  the 
EU. 

would 

help 
CIWIN 
the 
overcoming 
fragmentation 
CIP 
research  efforts  in  through 
better co-ordination and co-
operation. 

of 

Option 
5: 
compulsory 
system 

secure 

and 
multi-level 

All  Member  States  would 
participate in the system. 

Member  States  would  not 
support the proposal. 

A  system  of  obligations 
might not contribute to trust 
building 
would 
and 
backfire. 

The 
run 
system  might 
counter  to  the  principle  of 
proportionality. 

The  information  included 
will  go  beyond  what  is 
already publicly available. 

The  system  would  enable 
alerts to be exchanged. 

CIWIN  would  offer  an 
efficient,  easy  to  use  IT 
system. 

CIWIN would contribute to 
increasing  security  in  the 
EU. 

would 

help 
CIWIN 
the 
overcoming 
fragmentation 
CIP 
research  efforts  in  through 
better co-ordination and co-
operation. 

of 

EN 

5 

   EN 

 
5. 

PREFERRED OPTION 

After analysing the five options, Option 4 — CIWIN as a secure voluntary/opt-in multi-level 
communication/alert system composed of two distinct functions: a rapid alert system and an 
electronic forum for the exchange of CIP ideas and best practices — clearly showed the most 
advantageous ratio between benefits and drawbacks.  

It has to be stressed that CIWIN will not revolutionise EU security, and needs to be regarded 
as only one of many steps towards implementing the EPCIP. CIWIN is an IT tool designed to 
facilitate  communication  around  CIP  topics  and  provides  such  functions  as  news  bulletin 
boards, discussion groups, collaborative environments, document and workflow management 
features  that  are  part  of  everyday  internet  or  corporate  intranet  experience.  Work  on  the 
CIWIN will consider a large number of features, while ensuring that their existence and use 
can  be  suppressed  in  situations  where  they  are  not  seen  to  add  any  value  or  where  they 
conflict with established practices. 

EN 

6 

   EN