Panel: Future scenarios for European critical infrastructures protection

1. Panel: Future scenarios for European critical infrastructures protection Carlos Martí Sempere. Essen. October 5, 2010

2. What are critical infrastructures? An asset, system or part thereof located in Member States, which is essential for the maintenance of vital societal functions, health, safety, security, economic or social well-being of people, and the disruption or destruction of which would have a significant impact in a Member State as a result of the failure to maintain those functions (Source: Directive 2008/114/EC).

3. Most relevant infrastructures Transport and distribution Energy Information and communications Health Water Banking and finance Food supply chain Chemical industry Government key services

4. Why they need protection? The disruption or destruction of a critical infrastructure would have a significant impact on society with important negative consequences on society welfare and economy. Because critical infrastructures usually have strong interdependencies, the failure of one of them (e.g., energy, telecommunications) may have a large impact in other infrastructures. Protection is needed to face: Natural disasters Man-made disasters. Being so crucial these infrastructures are very attractive targets for terrorism or organised crime.

5. What is the EU policy on Critical Infrastructures Protection? According to the Treaty, EU institutions play a subsidiary role in the protection of critical infrastructures, being Member States responsible of implementing the adequate measures. The EU, however, wants to play a significant role for those infrastructures with an European dimension, i.e., those infrastructures that being disrupted or damaged may have consequences in more than one Member State. An European Program for Critical Infrastructures Protection (EPCIP) was launched by the Commission in 2006 within the general programme of “Securing and Safeguarding of Liberties”. A Critical Infrastructures Warning Information Network (CIWIN) has been developed by EU Commission. Directive 2008/114/EC focuses in the the identification and designation of European critical infrastructures and the assessment of the need to improve their protection. The Directive is a very positive step. It requires that European Critical Infrastructures shall have a security officer and shall have adequate contingency plans to face potential threats and disasters.

6. What are the main challenges of critical infrastructures protection? Critical infrastructure are the main candidates to apply protective measures, because it pays off to protect the riskiest assets of society. However, Critical Infrastructures are often owned, operated or managed by private companies (not necessarily by the State). Since private benefits of protecting such infrastructures may be lower that social benefits the private sector may underinvest in security measures. Therefore, States need to create appropriate incentives to increase protection. This may involve different measures such as regulations or subsidies. Sharing the final cost of protection between public and private organisations is a relevant issue to solve. Even focusing protection on critical infrastructures the number or assets is too large to achieve full protection. Priorities are not easy to set, and even may be of no help considering that terrorist and organised crime are able to easily switch to less protected (but still attractive) infrastructure targets.

7. Has the security industry something to say for improving protection? There are many ways to protect Critical Infrastructures from preparedness, to prevention, response and recovery. The human being may play a critical role in the early detection and identification of potential threats and in mitigating potential damages. Yet, efficiency of protection can be largely improved with technology in terms of increased awareness, fewer human resources, and higher difficulties of perpetrators to attack successfully. Surveillance systems, identity verification and authentication, access control system, intrusion detection systems, computer and communications systems security software, cargo and passenger inspection equipment are examples of products with which the industry can provide affordable and effective solutions that will improve the protection of Critical Infrastructures.

8. Resume The protection of critical infrastructures is a costly but necessary task in advanced societies. Its improvement requires first of all political willingness, but also: Careful threat analysis and risk assessment to identify vulnerabilities Analysis of alternatives to identify the best solution Public / private dialogue, cooperation and partnership Adequate social consensus to make the best choice Coordination between Member States when only joint measures are effective. Adequate budgets to finance the implementation of measures Appropriate legislation to implement and support agreed measures. Industrial capabilities to develop optimal solutions.

9. Isdefe Your best ally